hanoman 0.9.37 → 0.9.39

package/dist/server.js

@@ -4273,12 +4273,13 @@ function stampSpecMethod(payload, methodId) {
   if (typeof payload !== "object" || Array.isArray(payload)) return null;
   return { ...payload, method: methodId };
 }
-var DEFAULT_METHOD, VERIFICATION_GATE, MATT_CLAUSE, AGENT_SKILLS_CLAUSE, METHODS, METHOD_IDS, uniq, PLAN_DIRS, SPEC_DIRS;
+var DEFAULT_METHOD, VERIFICATION_GATE, MOCKUP_SKILL, MATT_CLAUSE, AGENT_SKILLS_CLAUSE, METHODS, METHOD_IDS, uniq, PLAN_DIRS, SPEC_DIRS;
 var init_method_catalog = __esm({
   "../shared/src/method-catalog.ts"() {
     "use strict";
     DEFAULT_METHOD = "superpowers";
     VERIFICATION_GATE = "superpowers:verification-before-completion";
+    MOCKUP_SKILL = "codex-image";
     MATT_CLAUSE = "Skill mattpocock yang kontraknya mewawancarai manusia (`/grill-me`, `/to-spec`, `/triage`) JANGAN dipakai: pakai primitif model-invoked-nya untuk menguji rancanganmu sendiri, bukan untuk mewawancarai siapa pun. Hal yang masih ambigu dan akan mempengaruhi hasil tetap JANGAN diputuskan sendiri \u2014 bila kamu agen fase, daftarkan di `Keputusan terbuka:` laporanmu; bila tidak, ajukan lewat jalur tanya di klausa otonomi prompt ini. `to-tickets` di fase Plan dipakai HANYA sebagai penghasil berkas plan berkotak `- [ ]` di `docs/matt/plans/`, BUKAN penerbit tiket \u2014 hanoman sendiri adalah issue tracker-nya, jadi jangan menulis ke tracker eksternal mana pun.";
     AGENT_SKILLS_CLAUSE = "Pakai skill Agent Skills langsung sesuai fase, bukan slash-command atau meta-router `using-agent-skills`. Kontrak fase, instruksi project/pengguna, dan jalur keputusan/review hanoman tetap berlaku: `spec-driven-development` hanya menyusun spec pada fase Spec, jangan menjalankan Plan atau Execute dari fase itu. Simpan spec di `docs/agent-skills/specs/` dan plan beserta SELURUH checklist task `- [ ]` di `docs/agent-skills/plans/`, dengan id backlog pada nama berkas; ini menggantikan default `SPEC.md`, `tasks/plan.md`, dan `tasks/todo.md` upstream. Jangan menimpa plan lain yang belum tuntas atau membuat tiket di tracker eksternal: hanoman adalah issue tracker-nya. Centang task di berkas plan yang sama setelah implementasi dan verifikasi. Hal ambigu yang mempengaruhi hasil mengikuti jalur tanya prompt ini; bila kamu agen fase, daftarkan di `Keputusan terbuka:` laporanmu.";
     METHODS = {
@@ -4293,6 +4294,7 @@ var init_method_catalog = __esm({
         phaseSkills: {
           Brainstorm: ["superpowers:brainstorming"],
           Audit: ["superpowers:systematic-debugging"],
+          Mockup: [MOCKUP_SKILL],
           Plan: ["superpowers:writing-plans"],
           Execute: [
             "superpowers:executing-plans",
@@ -4338,6 +4340,7 @@ var init_method_catalog = __esm({
         phaseSkills: {
           Brainstorm: ["mattpocock-skills:grilling"],
           Audit: ["mattpocock-skills:diagnosing-bugs"],
+          Mockup: [MOCKUP_SKILL],
           Plan: ["mattpocock-skills:to-tickets"],
           Execute: [
             "mattpocock-skills:implement",
@@ -4376,6 +4379,7 @@ var init_method_catalog = __esm({
         phaseSkills: {
           Brainstorm: ["agent-skills:idea-refine"],
           Spec: ["agent-skills:spec-driven-development"],
+          Mockup: [MOCKUP_SKILL],
           Audit: [
             "agent-skills:debugging-and-error-recovery",
             "agent-skills:code-review-and-quality"
@@ -4419,7 +4423,7 @@ var init_method_catalog = __esm({
 
 // ../shared/src/method-status.ts
 function methodSkills(m) {
-  return [.../* @__PURE__ */ new Set([...Object.values(m.phaseSkills).flat(), ...m.exitSkills])];
+  return [.../* @__PURE__ */ new Set([...Object.values(m.phaseSkills).flat(), ...m.exitSkills])].filter((id2) => !HANOMAN_PROVIDED_SKILLS.has(id2));
 }
 function methodStatus(m, agent, installed2) {
   const haveSkills = new Set(installed2.skills);
@@ -4437,10 +4441,12 @@ function methodStatus(m, agent, installed2) {
     install: [...m.install[agent]]
   };
 }
-var ANTIGRAVITY_METHOD_UNAVAILABLE_REASON;
+var HANOMAN_PROVIDED_SKILLS, ANTIGRAVITY_METHOD_UNAVAILABLE_REASON;
 var init_method_status = __esm({
   "../shared/src/method-status.ts"() {
     "use strict";
+    init_method_catalog();
+    HANOMAN_PROVIDED_SKILLS = /* @__PURE__ */ new Set([MOCKUP_SKILL]);
     ANTIGRAVITY_METHOD_UNAVAILABLE_REASON = "Installer metode Antigravity belum terverifikasi dari upstream";
   }
 });
@@ -5174,7 +5180,7 @@ var init_logs = __esm({
 function phaseAgentName(phase) {
   return PHASE_AGENT_PREFIX + phase.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
-var ORCHESTRATION_FLOWS, FLOW_PHASES, PHASE_AGENT_PREFIX, isPhaseAgentName, PHASE_EVIDENCE_GRACE_MS, EXECUTE_MODE_FLOWS, REVIEWER_CELL, REVIEWER_FLOWS, REVIEWER_DEFAULTS, UNSKIPPABLE_PHASES;
+var ORCHESTRATION_FLOWS, FLOW_PHASES, PHASE_AGENT_PREFIX, isPhaseAgentName, PHASE_EVIDENCE_GRACE_MS, EXECUTE_MODE_FLOWS, REVIEWER_CELL, REVIEWER_FLOWS, REVIEWER_DEFAULTS, UNSKIPPABLE_PHASES, MOCKUP_PHASE, OPTIONAL_PHASES;
 var init_orchestration = __esm({
   "../shared/src/orchestration.ts"() {
     "use strict";
@@ -5191,8 +5197,10 @@ var init_orchestration = __esm({
     ];
     FLOW_PHASES = {
       // ADR-0230 · `Review` = fase resmi sesudah Execute (dulu langkah R di dalam Execute, ADR-0170 #4).
-      feature: ["Brainstorm", "Objective", "Spec", "Plan", "Execute", "Review"],
-      qa: ["Audit", "Spec", "Plan", "Execute", "Review"],
+      // ADR-0233 · `Mockup` = fase opsional sesudah Spec: gambar UI disetujui sebelum Plan, dilewati agen
+      // bila backlog tak menyentuh UI.
+      feature: ["Brainstorm", "Objective", "Spec", "Mockup", "Plan", "Execute", "Review"],
+      qa: ["Audit", "Spec", "Mockup", "Plan", "Execute", "Review"],
       scaffold: ["Brainstorm", "Objective", "Doc index"],
       reverse: ["Scan", "Docs teknis", "Wawancara", "Konvensi & index", "Serah terima"],
       prd: ["Brainstorm", "PRD"],
@@ -5224,6 +5232,8 @@ var init_orchestration = __esm({
       antigravity: { model: "inherit", effort: null }
     };
     UNSKIPPABLE_PHASES = /* @__PURE__ */ new Set([REVIEWER_CELL]);
+    MOCKUP_PHASE = "Mockup";
+    OPTIONAL_PHASES = /* @__PURE__ */ new Set([MOCKUP_PHASE]);
   }
 });
 
@@ -5234,7 +5244,7 @@ var init_runtime_defaults = __esm({
     "use strict";
     init_orchestration();
     init_zod();
-    RUNTIME_DEFAULTS_VERSION = "2026-10-25-v1";
+    RUNTIME_DEFAULTS_VERSION = "2026-10-31-v1";
     zRuntimeDefaultState = external_exports.enum(["seeded", "user"]);
     zBuiltinRuntimeDefaults = external_exports.object({
       version: external_exports.string().default(RUNTIME_DEFAULTS_VERSION),
@@ -5290,6 +5300,7 @@ var init_runtime_defaults = __esm({
           Brainstorm: cell("sonnet", "medium"),
           Objective: cell("sonnet", "medium"),
           Spec: cell("opus", "high"),
+          Mockup: cell("sonnet", "medium"),
           Plan: cell("opus", "high"),
           Execute: cell("sonnet", "high"),
           Review: cell("opus", "high")
@@ -5298,6 +5309,7 @@ var init_runtime_defaults = __esm({
           Brainstorm: cell("gpt-5.6-terra", "medium"),
           Objective: cell("gpt-5.6-terra", "medium"),
           Spec: cell("gpt-5.6-sol", "high"),
+          Mockup: cell("gpt-5.6-terra", "medium"),
           Plan: cell("gpt-5.6-sol", "high"),
           Execute: cell("gpt-5.6-terra", "high"),
           Review: cell("gpt-5.6-sol", "high")
@@ -5307,6 +5319,7 @@ var init_runtime_defaults = __esm({
         {
           Audit: cell("opus", "high"),
           Spec: cell("opus", "high"),
+          Mockup: cell("sonnet", "medium"),
           Plan: cell("sonnet", "high"),
           Execute: cell("sonnet", "high"),
           Review: cell("opus", "high")
@@ -5314,6 +5327,7 @@ var init_runtime_defaults = __esm({
         {
           Audit: cell("gpt-5.6-sol", "high"),
           Spec: cell("gpt-5.6-sol", "high"),
+          Mockup: cell("gpt-5.6-terra", "medium"),
           Plan: cell("gpt-5.6-terra", "high"),
           Execute: cell("gpt-5.6-terra", "high"),
           Review: cell("gpt-5.6-sol", "high")
@@ -7699,7 +7713,7 @@ function subKey(topic, params) {
   for (const k of Object.keys(params).sort()) if (params[k] !== void 0) canon[k] = params[k];
   return `${topic}|${JSON.stringify(canon)}`;
 }
-var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zUpdateProject, zCreateSpec, zPatchSpec, zChangeSpecSource, zMarkSpecDone, zMarkSpecReviewed, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerQueueCounts, zSchedulerState, zLeadDecisionView, zLeadFlowView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, isGoalShapedFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, USER_ROLES, zUserRole, zLogin, zSignup, zSetup, zSetupApply, zChangePassword, zAdminPasswordReset, zCreateClientAccount, zUpdateClientAccount, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, PROVISION_PROFILES, COMPONENT_IDS, zProvision, UPDATE_RESTART_EXIT, CONFIG_RESTART_EXIT, MANUAL_RESTART_EXIT, EXIT_INTENT_FILE, zUpdateApplyBody, MAX_SUBS, zSubPage, zSubLimit, zTopicParams, zEventsClientMsg, zTicketView, zTicketAttachmentView, zSpecAttachmentView, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus, zCronExpr, zCreateCron, zPatchCron, zSchedulerCron, zSchedulerCronRun;
+var zIssueDeviceToken, zSessionResult, zSessionHistory, zCreateProject, zProjectId, zRenameProject, zUpdateProject, zCreateSpec, zPatchSpec, zChangeSpecSource, zMarkSpecDone, zMarkSpecReviewed, zIntegrate, zSessionSummary, zProjectView, zSchedulerQueueItem, zSchedulerSourceView, zSchedulerSessionView, zSchedulerQueueCounts, zSchedulerState, zLeadDecisionView, zLeadFlowView, zLeadAnswer, zLeadProjectStatus, zLeadStatusView, zFlow, isGoalShapedFlow, zPrdBrief, zPrdDoc, zBreakdownItem, zBreakdownDoc, zBatchCreateSpec, zEscalationTarget, zEscalationPrefill, zAuditEscalation, zAuditEscalationView, zTerminalSession, zDocFileContent, zDocIndexCat, zDocIndex, HOST_RE, USER_RE, zCreateVps, zPatchVps, USER_ROLES, zUserRole, zLogin, zSignup, zSetup, zSetupApply, zChangePassword, zAdminPasswordReset, zCreateClientAccount, zUpdateClientAccount, zVpsCheck, zMarkNa, zMarkNaBulk, zAttest, zRemediate, PROVISION_PROFILES, COMPONENT_IDS, zProvision, UPDATE_RESTART_EXIT, CONFIG_RESTART_EXIT, MANUAL_RESTART_EXIT, EXIT_INTENT_FILE, zUpdateApplyBody, MAX_SUBS, zSubPage, zSubLimit, zTopicParams, zEventsClientMsg, zTicketView, zTicketAttachmentView, zSpecAttachmentView, zMockupItem, zSpecMockups, zTicketDetail, zTicketEditInput, zHelpInfo, zPublicTicketStatus, zCronExpr, zCreateCron, zPatchCron, zSchedulerCron, zSchedulerCronRun;
 var init_dto = __esm({
   "../shared/src/dto.ts"() {
     "use strict";
@@ -8323,6 +8337,12 @@ var init_dto = __esm({
       size: external_exports.number().int(),
       createdAt: external_exports.string()
     });
+    zMockupItem = external_exports.object({ name: external_exports.string(), size: external_exports.number().int(), modifiedAt: external_exports.string() });
+    zSpecMockups = external_exports.object({
+      source: external_exports.enum(["worktree", "repo"]).nullable(),
+      dir: external_exports.string().nullable(),
+      items: external_exports.array(zMockupItem)
+    });
     zTicketDetail = zTicketView.extend({
       detail: external_exports.string(),
       attachments: external_exports.array(zTicketAttachmentView),
@@ -8473,6 +8493,9 @@ var init_api = __esm({
       // SPEC-843 · ADR-0124 · lampiran backlog item (multi-berkas per request).
       specAttachments: (id2) => `${API}/specs/${id2}/attachments`,
       specAttachment: (id2, attId) => `${API}/specs/${id2}/attachments/${attId}`,
+      // ADR-0233 · mockup UI backlog (docs/mockups/<spec-id>/).
+      specMockups: (id2) => `${API}/specs/${id2}/mockups`,
+      specMockup: (id2, name2) => `${API}/specs/${id2}/mockups/${encodeURIComponent(name2)}`,
       specReview: (id2) => `${API}/specs/${id2}/review`,
       specReviewFile: (id2, path) => `${API}/specs/${id2}/review/${path}`,
       // ADR-0213 · hapus worktree satu backlog item (cabang & commit tetap).
@@ -11228,6 +11251,19 @@ var init_backlog = __esm({
         build: (a) => ({ method: "GET", path: `/specs/${enc(String(a.spec))}/attachments` }),
         shape: (raw) => raw
       },
+      // ADR-0233 · mockup UI hasil fase Mockup, dibaca dari worktree sesi atau checkout project.
+      {
+        name: "hanoman_backlog_mockups_list",
+        title: "Daftar mockup backlog",
+        description: "Daftar gambar mockup UI sebuah backlog item (hasil fase Mockup, `docs/mockups/<spec-id>/`): `source` (`worktree` sesi atau `repo` checkout project, null bila belum ada), `dir` (path absolut folder di MESIN SERVER hanoman \u2014 baca langsung bila kamu di mesin yang sama), dan `items` {name, size, modifiedAt}. Unduh satu gambar ke disk klien dengan hanoman_backlog_mockup_download.",
+        inputSchema: obj({ properties: { spec: str(ID_HINT) }, required: ["spec"] }),
+        mode: "read",
+        capability: "backlog:read",
+        samplePath: "/specs/SPEC-1/mockups",
+        sampleMethod: "GET",
+        build: (a) => ({ method: "GET", path: `/specs/${enc(String(a.spec))}/mockups` }),
+        shape: (raw) => raw
+      },
       {
         name: "hanoman_backlog_attachment_delete",
         title: "Hapus lampiran backlog",
@@ -14846,6 +14882,26 @@ var init_transfer = __esm({
         build: (a) => ({ method: "GET", path: `${specOne(a)}/${enc(String(a.attachment))}`, download: dlFile(a, "lampiran") }),
         shape: (raw) => raw
       },
+      // ADR-0233 · mockup UI backlog (`docs/mockups/<spec-id>/`), biner → transfer tool (preseden ADR-0183).
+      {
+        name: "hanoman_backlog_mockup_download",
+        title: "Unduh mockup backlog",
+        description: `Mengunduh SATU gambar mockup UI backlog item ke disk lokal klien MCP. Nama berkas dari hanoman_backlog_mockups_list. ${DOWNLOAD_RESULT}`,
+        inputSchema: obj({
+          properties: { spec: SPEC, name: str("Nama berkas mockup, mis. `01-backlog-detail.png`."), savePath: SAVE_PATH, overwrite: OVERWRITE },
+          required: ["spec", "name"]
+        }),
+        mode: "write",
+        capability: "backlog:read",
+        samplePath: "/specs/SPEC-1/mockups/01-x.png",
+        sampleMethod: "GET",
+        build: (a) => ({
+          method: "GET",
+          path: `/specs/${enc(String(a.spec))}/mockups/${enc(String(a.name))}`,
+          download: dlFile(a, String(a.name ?? "mockup.png"))
+        }),
+        shape: (raw) => raw
+      },
       // ───────────────────────── lampiran tiket ─────────────────────────
       {
         name: "hanoman_ticket_attachment_download",
@@ -17395,6 +17451,7 @@ function orchestratorClause(plan, o = {}) {
   const askEscalation = codex2 || antigravity2 ? "tanyakan di terminal ini lalu tunggu jawaban" : ASK_ESCALATION_TOOL;
   const askDecisions = antigravity2 ? "di terminal ini sekaligus dalam satu pesan, tiap pertanyaan bernomor dan diakhiri `?` beserta opsi, rekomendasi dan alasannya, lalu tunggu jawaban" : codex2 ? "di terminal ini sekaligus dalam satu pesan, tiap pertanyaan bernomor dan diakhiri `?` beserta opsinya, lalu tunggu jawaban" : ASK_DECISIONS_TOOL;
   const turnTaking = plan.flow === "reverse" || plan.flow === "scaffold" || plan.flow === "prd" ? " Fase yang bergiliran dengan manusia (Wawancara, Brainstorm prd/scaffold) melapor satu topik per putaran \u2014 relay tiap putaran dengan cara yang sama, bawa konteks & opsi dari laporannya, dan biarkan jawaban bebas." : "";
+  const mockupStep = plan.phases.some((p3) => p3.phase === MOCKUP_PHASE) ? 'M. Fase Mockup: laporan `Status: selesai` dengan `Rekomendasi fase: lewati` \u2192 jalankan `echo "Mockup skipped" >> "$HANOMAN_PHASE_FILE"` (gerbang yang sama seperti langkah 2), BUKAN `Mockup done`. Permintaan persetujuan mockup datang sebagai `Keputusan terbuka:` \u2014 relay lewat langkah 4 apa adanya, termasuk path gambar dan baris `Lihat di hanoman:`; jangan menyetujuinya sendiri.' : "";
   const handoff = plan.phases.some((p3) => p3.phase === "Serah terima") ? "Sesudah fase Serah terima tercatat, tampilkan bagian `Ringkasan serah terima:` dari laporannya APA ADANYA ke manusia di terminal ini (teks biasa \u2014 informasi, bukan pertanyaan) sebelum menutup pekerjaan." : "";
   const runtimeLabel = (entry2) => antigravity2 ? `tier native ${entry2.model} \xB7 effort native unknown` : `${entry2.model} \xB7 ${entry2.effort}`;
   const phaseList = plan.phases.map((p3, i) => `${i + 1}. ${p3.phase} \u2192 \`${p3.agentName}\` \xB7 ${runtimeLabel(p3)}`).join("\n");
@@ -17425,7 +17482,8 @@ ${artefactRule} ${describeRule}`,
     '2. Baca laporannya. `Status: selesai` DENGAN bukti \u2192 SEBELUM hal lain (memanggil fase berikutnya, commit, atau push): jalankan persis `echo "<Nama Fase> done" >> "$HANOMAN_PHASE_FILE"`, lalu verifikasi dengan `tail -1 "$HANOMAN_PHASE_FILE"` bahwa barisnya benar tertulis. Kamu satu-satunya penulis berkas itu.' + (review ? " Khusus Review: marker hanya sesudah `Verdict: lulus` (langkah R)." : ""),
     `3. \`Status: sebagian\`/\`terhalang\`, galat, atau laporan tanpa bukti \u2192 delegasikan ULANG SEKALI ke subagent fase yang sama${retry} dengan laporan gagalnya disertakan (\`Percobaan: 2/2\`). Gagal lagi \u2192 BERHENTI dan ${askEscalation} apa yang harus dilakukan. Aturan ini berlaku walau klausa otonomi di prompt ini menyuruhmu tak bertanya.`,
     `4. \`Status: menunggu-keputusan\` atau \`Keputusan terbuka:\` yang bukan \`-\` \u2192 SEBELUM menulis marker fase atau memanggil fase berikutnya, ajukan SEMUA pertanyaannya ${askDecisions}, lalu LANJUTKAN subagent yang SAMA lewat ${resume} dengan seluruh jawabannya. Ulangi selama subagent masih melaporkan keputusan terbuka \u2014 tak ada batas jumlah pertanyaan maupun putaran, dan giliran relay ini bukan percobaan ulang. JANGAN pernah menjawab sendiri, termasuk di sesi scheduler: yang menjawab ${DECIDER} \u2014 hanoman yang merutekannya, kamu cukup bertanya.${turnTaking}`,
-    o.fastPath ? '5. `Rekomendasi fase: jalur-cepat` sesudah Audit \u2192 SEBELUM lanjut ke Execute: jalankan `echo "Spec skipped" >> "$HANOMAN_PHASE_FILE"` lalu `echo "Plan skipped" >> "$HANOMAN_PHASE_FILE"` (gerbang yang sama seperti langkah 2), lalu lanjut ke Execute. `penuh` \u2192 Spec \u2192 Plan \u2192 Execute.' : "",
+    o.fastPath ? '5. `Rekomendasi fase: jalur-cepat` sesudah Audit \u2192 SEBELUM lanjut ke Execute: jalankan `echo "Spec skipped" >> "$HANOMAN_PHASE_FILE"`, `echo "Mockup skipped" >> "$HANOMAN_PHASE_FILE"`, lalu `echo "Plan skipped" >> "$HANOMAN_PHASE_FILE"` (gerbang yang sama seperti langkah 2), lalu lanjut ke Execute. `penuh` \u2192 Spec \u2192 Mockup \u2192 Plan \u2192 Execute.' : "",
+    mockupStep,
     reviewStep,
     handoff,
     "DILARANG mengerjakan isi fase sendiri \u2014 termasuk saat subagent gagal. Menulis `skipped` untuk fase yang dilewati bukan mengerjakannya.",
@@ -17664,7 +17722,7 @@ Stack: ${project.stack || "\u2014"}`,
 ${cron.prompt}`
   ].join("\n\n");
 }
-var PIPELINES, WORK_PHASES, DECIDER, ASK_ROUTE, ASK_ESCALATION_TOOL, ASK_DECISIONS_TOOL, AMBIGUOUS, AUTONOMY_CLAUSE, AUTONOMY_CLAUSE_FULL, autonomyClause, PLAN_SHAPE, phaseInstruction, SELF_REVIEW_CLAUSE, skillInstruction, auditDecisionInstruction, ESCALATION_CONTRACT, auditOnlyInstruction, auditContinuationInstruction, auditContinuationForOrchestrator, writesCode, scopeClause, codeStyleClause, methodClause, attachmentClause, orchestratorAttachmentClause, PROJECT_METHOD, specContext, goalDetail, goalBlock, goalContext, projectContext, scaffoldContext, prdBriefBlock, prdAuditBlock, prdContext, breakdownContext, prdPhaseLines, breakdownPhaseLines, resumeClause, RESUMED_WORKTREE_NOTE, REVERSE_PHASE_GUIDE, SCAFFOLD_PHASE_GUIDE;
+var PIPELINES, WORK_PHASES, DECIDER, ASK_ROUTE, ASK_ESCALATION_TOOL, ASK_DECISIONS_TOOL, AMBIGUOUS, AUTONOMY_CLAUSE, AUTONOMY_CLAUSE_FULL, autonomyClause, PLAN_SHAPE, phaseInstruction, SELF_REVIEW_CLAUSE, mockupGuide, MOCKUP_FOLLOW_UP, MOCKUP_SINGLE, skillInstruction, auditDecisionInstruction, ESCALATION_CONTRACT, auditOnlyInstruction, auditContinuationInstruction, auditContinuationForOrchestrator, writesCode, scopeClause, codeStyleClause, methodClause, attachmentClause, orchestratorAttachmentClause, PROJECT_METHOD, specContext, goalDetail, goalBlock, goalContext, projectContext, scaffoldContext, prdBriefBlock, prdAuditBlock, prdContext, breakdownContext, prdPhaseLines, breakdownPhaseLines, resumeClause, RESUMED_WORKTREE_NOTE, REVERSE_PHASE_GUIDE, SCAFFOLD_PHASE_GUIDE;
 var init_prompt = __esm({
   "../runner/src/prompt.ts"() {
     "use strict";
@@ -17688,12 +17746,23 @@ var init_prompt = __esm({
       const base3 = `Kerjakan fase berurutan: ${phases2.join(" \u2192 ")}.
 Setiap kali sebuah fase selesai (atau kamu putuskan dilewati), append satu baris ke berkas di $HANOMAN_PHASE_FILE \u2014 persis: \`echo "<Nama Fase> done" >> "$HANOMAN_PHASE_FILE"\`, atau \`skipped\` sebagai ganti \`done\`. Nama fase ditulis apa adanya seperti di atas.`;
       if (!phases2.includes("Plan") || !phases2.includes("Execute")) return base3;
-      return base3 + `
+      return base3 + (phases2.includes(MOCKUP_PHASE) ? `
+${MOCKUP_SINGLE}
+${MOCKUP_FOLLOW_UP.Plan} ${MOCKUP_FOLLOW_UP.Execute}` : "") + `
 Execute BELUM selesai selama plan (\`${method.planDir}/**\`) masih punya task \`- [ ]\`: kerjakan SEMUA PR/task sampai tiap kotak jadi \`- [x]\` sebelum menulis \`Execute done\`. hanoman menahan backlog di \`executing\`, bukan \`done\`, selama masih ada \`- [ ]\`.
 ${PLAN_SHAPE}` + (phases2.includes(REVIEWER_CELL) ? `
 ${SELF_REVIEW_CLAUSE}` : "");
     };
-    SELF_REVIEW_CLAUSE = "Fase Review (sesudah `Execute done`): periksa ulang hasil Execute terhadap dokumen spec & plan backlog ini \u2014 baca seluruh perubahan sesi ini (diff dari commit awal worktree) dan jalankan test sesuai scope verifikasi. Tulis tabel `AC \u2192 putusan \u2192 bukti` (setiap acceptance criteria \u2192 perintah & hasil yang kamu baca, atau path:baris) lalu satu baris `Verdict: lulus` atau `Verdict: rework`. `rework` \u2192 perbaiki temuannya, lalu review ulang; maks 2 putaran rework, sisanya jadi keputusan terbuka. Tulis `Review done` HANYA sesudah `Verdict: lulus`; Review TIDAK PERNAH `skipped`.";
+    SELF_REVIEW_CLAUSE = "Fase Review (sesudah `Execute done`): periksa ulang hasil Execute terhadap dokumen spec & plan backlog ini \u2014 baca seluruh perubahan sesi ini (diff dari commit awal worktree) dan jalankan test sesuai scope verifikasi. Tulis tabel `AC \u2192 putusan \u2192 bukti` (setiap acceptance criteria \u2192 perintah & hasil yang kamu baca, atau path:baris) lalu satu baris `Verdict: lulus` atau `Verdict: rework`. `rework` \u2192 perbaiki temuannya, lalu review ulang; maks 2 putaran rework, sisanya jadi keputusan terbuka. Tulis `Review done` HANYA sesudah `Verdict: lulus`; Review TIDAK PERNAH `skipped`. Bila `docs/mockups/<spec-id>/` ada, tabel itu juga memuat kesesuaian hasil dengan mockup yang disetujui.";
+    mockupGuide = (ask, close) => `putuskan dulu dari dokumen spec (qa jalur cepat: dokumen audit) apakah backlog ini mengubah atau membuat UI \u2014 layar, komponen, atau state yang terlihat pengguna. Tidak ada (perbaikan backend, CLI, refactor, docs) \u2192 fase ini dilewati, sebutkan alasannya dalam satu baris; ragu \u2192 anggap ada UI. Ada \u2192 baca design system project bila ada (mis. \`internal/docs/design-system/**\`, \`DESIGN.md\`) dan kode layar yang akan berubah, muat skill \`codex-image\`, lalu hasilkan SATU gambar per layar/state yang berubah, maks 6: desktop \`1536x1024\`, tambah mobile \`1024x1536\` bila layout responsif tersentuh, ke \`docs/mockups/<spec-id>/<NN>-<slug>.png\` (spec-id huruf kecil, NN dua digit urut). Tambahkan bagian \`## Mockup\` di dokumen spec: tiap berkas, layar/state yang ditunjukkannya, dan apa yang berubah. Lalu minta persetujuan ${ask}: sebutkan path absolut setiap gambar dan baris \`Lihat di hanoman: Backlog <SPEC-ID> \u2192 Mockup\`, dengan opsi Setujui \xB7 Revisi (beserta catatan) \xB7 Lewati mockup. Revisi \u2192 buat ulang gambar yang diminta dengan spec gambar LENGKAP ditambah koreksinya (bukan koreksinya saja), timpa berkas yang sama, lalu minta persetujuan lagi. Lewati \u2192 hapus berkas mockup yang belum di-commit. Disetujui \u2192 commit \`docs/mockups/<spec-id>/\` beserta dokumen spec. Bila gambar tak bisa dihasilkan (Codex tak terpasang/belum login, image_gen gagal dua kali), JANGAN membuat pengganti (SVG/CSS/HTML yang dirasterisasi, emoji, atau placeholder bernama sama) \u2014 tanyakan dengan jalur yang sama: tunggu operator menjalankan \`codex login\` lalu lanjut, atau lewati mockup. ${close}`;
+    MOCKUP_FOLLOW_UP = {
+      Plan: "Bila `docs/mockups/<spec-id>/` ada, setiap task UI di plan merujuk berkas mockup yang diwujudkannya.",
+      Execute: "Bila `docs/mockups/<spec-id>/` ada, bangun UI dengan kode sesuai mockup itu \u2014 PNG mockup bukan aset produk."
+    };
+    MOCKUP_SINGLE = "Fase Mockup: " + mockupGuide(
+      "lewat jalur tanya di klausa otonomi prompt ini",
+      "Tulis `Mockup done` sesudah disetujui & di-commit, atau `Mockup skipped` bila dilewati."
+    );
     skillInstruction = (flow2, phases2, method) => {
       const lines2 = phases2.map((p3) => {
         const skills2 = phaseSkillsFor(flow2, p3, method);
@@ -17702,7 +17771,7 @@ ${SELF_REVIEW_CLAUSE}` : "");
       return lines2.length ? `Skills ${method.label} WAJIB: sebelum mengerjakan fase di bawah, muat & ikuti skill-nya dengan mekanisme yang tersedia di agenmu \u2014 bila skill relevan tersedia, pakai.
 ${lines2.join("\n")}` : "";
     };
-    auditDecisionInstruction = (flow2) => flow2 !== "qa" ? "" : 'Keputusan pasca-Audit (qa): bila temuan berconfidence tinggi dan perbaikannya bisa dikerjakan langsung (diff kecil, akar masalah jelas), LEWATI Spec dan Plan \u2014 tandai keduanya `skipped` (`echo "Spec skipped" >> "$HANOMAN_PHASE_FILE"` lalu `echo "Plan skipped" >> "$HANOMAN_PHASE_FILE"`) dan langsung ke Execute; dokumen audit menjadi doc-of-record perbaikan itu. Bila temuan luas, berisiko, atau ambigu, jalankan Spec \u2192 Plan \u2192 Execute penuh. Keputusan ini milikmu berdasarkan hasil Audit, bukan default \u2014 jangan bayar perencanaan yang tak perlu untuk perbaikan sepele.';
+    auditDecisionInstruction = (flow2) => flow2 !== "qa" ? "" : 'Keputusan pasca-Audit (qa): bila temuan berconfidence tinggi dan perbaikannya bisa dikerjakan langsung (diff kecil, akar masalah jelas), LEWATI Spec, Mockup, dan Plan \u2014 tandai ketiganya `skipped` (`echo "Spec skipped" >> "$HANOMAN_PHASE_FILE"`, `echo "Mockup skipped" >> "$HANOMAN_PHASE_FILE"`, lalu `echo "Plan skipped" >> "$HANOMAN_PHASE_FILE"`) dan langsung ke Execute; dokumen audit menjadi doc-of-record perbaikan itu. Bila temuan luas, berisiko, atau ambigu, jalankan Spec \u2192 Mockup \u2192 Plan \u2192 Execute penuh. Keputusan ini milikmu berdasarkan hasil Audit, bukan default \u2014 jangan bayar perencanaan yang tak perlu untuk perbaikan sepele.';
     ESCALATION_CONTRACT = [
       "REKOMENDASI ESKALASI (wajib, terbaca mesin). Di bagian akhir dokumen audit, tulis bagian",
       "`## Rekomendasi eskalasi` berisi penjelasan singkat untuk manusia, LALU tepat SATU blok ```json",
@@ -17733,7 +17802,7 @@ ${lines2.join("\n")}` : "";
       const doc = `internal/docs/research/audit-${fromAudit.toLowerCase()}-*.md`;
       if (flow2 === "feature")
         return `Backlog brief ini LANJUTAN dari audit ${fromAudit}. Worktree ini lahir dari branch audit itu, jadi dokumen audit sudah ada di ${doc}. BACA dokumen itu lebih dulu dan pakai sebagai bahan fase Brainstorm & Objective \u2014 temuannya sudah terbukti, jangan menginvestigasi ulang dari nol. Semua fase tetap dijalankan: dokumen audit memuat TEMUAN, bukan bentuk solusi, jadi perancangan fitur tetap pekerjaanmu.`;
-      return `Backlog qa ini LANJUTAN dari audit ${fromAudit}. Worktree ini lahir dari branch audit itu, jadi dokumen audit sudah ada di ${doc}. JANGAN mengulang investigasi fase Audit dari nol \u2014 baca dokumen audit itu sebagai temuan, tandai fase Audit dilewati (\`echo "Audit skipped" >> "$HANOMAN_PHASE_FILE"\`), lalu ambil keputusan pasca-Audit: perbaikan jelas & kecil \u2192 langsung Execute (tandai \`Spec skipped\` dan \`Plan skipped\` bila sesuai); selain itu Spec \u2192 Plan \u2192 Execute penuh.`;
+      return `Backlog qa ini LANJUTAN dari audit ${fromAudit}. Worktree ini lahir dari branch audit itu, jadi dokumen audit sudah ada di ${doc}. JANGAN mengulang investigasi fase Audit dari nol \u2014 baca dokumen audit itu sebagai temuan, tandai fase Audit dilewati (\`echo "Audit skipped" >> "$HANOMAN_PHASE_FILE"\`), lalu ambil keputusan pasca-Audit: perbaikan jelas & kecil \u2192 langsung Execute (tandai \`Spec skipped\`, \`Mockup skipped\`, dan \`Plan skipped\` bila sesuai); selain itu Spec \u2192 Mockup \u2192 Plan \u2192 Execute penuh.`;
     };
     auditContinuationForOrchestrator = (flow2, spec) => {
       if (flow2 !== "qa" && flow2 !== "feature") return "";
@@ -17742,7 +17811,7 @@ ${lines2.join("\n")}` : "";
       const doc = `internal/docs/research/audit-${fromAudit.toLowerCase()}-*.md`;
       if (flow2 === "feature")
         return `Backlog brief ini LANJUTAN dari audit ${fromAudit}. Worktree ini lahir dari branch audit itu, jadi dokumen audit sudah ada di ${doc}. Saat memanggil agen fase Brainstorm, cantumkan path itu di baris \`Artefak fase sebelumnya:\` blok serah-terima \u2014 JANGAN membacanya sendiri untuk merancang fitur ini. Saat memanggil agen fase Objective, baris itu biasanya sudah membawa path artefak Brainstorm (dokumen spec yang ditulis fase itu); tambahkan path dokumen audit di samping path itu, bukan menggantikannya. Temuannya sudah terbukti, tapi bentuk solusinya belum; itu tetap dikerjakan agen fasenya masing-masing, bukan olehmu.`;
-      return `Backlog qa ini LANJUTAN dari audit ${fromAudit}. Temuannya sudah terbukti di ${doc} \u2014 JANGAN mendelegasikan ulang fase Audit. Sebelum fase lain: jalankan persis \`echo "Audit skipped" >> "$HANOMAN_PHASE_FILE"\`, verifikasi dengan \`tail -1 "$HANOMAN_PHASE_FILE"\` bahwa barisnya benar tertulis (gerbang yang sama seperti langkah 2), lalu cantumkan path dokumen audit itu di baris \`Artefak fase sebelumnya:\` saat memanggil agen fase Spec. Keputusan routing di sini menggantikan langkah 5 di atas \u2014 JANGAN menunggu frasa \`Rekomendasi fase: jalur-cepat\` dari agen Audit karena Audit tidak dijalankan pada kelanjutan ini. Kamu diizinkan mengambil SATU keputusan ROUTING dari isi dokumen audit itu SAJA, dibaca langsung dari kriterianya: temuan berconfidence tinggi dan perbaikan langsung berdiff kecil \u2192 tandai \`Spec skipped\` lalu \`Plan skipped\` (gerbang yang sama) lalu panggil agen fase Execute; selebihnya panggil Spec \u2192 Plan \u2192 Execute penuh lewat agen fasenya masing-masing. Kamu TIDAK menginvestigasi ulang maupun merancang perbaikannya sendiri \u2014 itu tetap pekerjaan agen fase.`;
+      return `Backlog qa ini LANJUTAN dari audit ${fromAudit}. Temuannya sudah terbukti di ${doc} \u2014 JANGAN mendelegasikan ulang fase Audit. Sebelum fase lain: jalankan persis \`echo "Audit skipped" >> "$HANOMAN_PHASE_FILE"\`, verifikasi dengan \`tail -1 "$HANOMAN_PHASE_FILE"\` bahwa barisnya benar tertulis (gerbang yang sama seperti langkah 2), lalu cantumkan path dokumen audit itu di baris \`Artefak fase sebelumnya:\` saat memanggil agen fase Spec. Keputusan routing di sini menggantikan langkah 5 di atas \u2014 JANGAN menunggu frasa \`Rekomendasi fase: jalur-cepat\` dari agen Audit karena Audit tidak dijalankan pada kelanjutan ini. Kamu diizinkan mengambil SATU keputusan ROUTING dari isi dokumen audit itu SAJA, dibaca langsung dari kriterianya: temuan berconfidence tinggi dan perbaikan langsung berdiff kecil \u2192 tandai \`Spec skipped\`, \`Mockup skipped\`, lalu \`Plan skipped\` (gerbang yang sama) lalu panggil agen fase Execute; selebihnya panggil Spec \u2192 Mockup \u2192 Plan \u2192 Execute penuh lewat agen fasenya masing-masing. Kamu TIDAK menginvestigasi ulang maupun merancang perbaikannya sendiri \u2014 itu tetap pekerjaan agen fase.`;
     };
     writesCode = (flow2) => PIPELINES[flow2].some((p3) => WORK_PHASES.includes(p3));
     scopeClause = (flow2, scope) => scope && writesCode(flow2) ? verifyScopeClause(scope) : "";
@@ -18062,7 +18131,7 @@ function defaultGoalCondition({ flow: flow2, specId, branchTo, spec }) {
   const phases2 = PIPELINES[flow2];
   const planGate = phases2.includes("Plan") && phases2.includes("Execute");
   const clauses = [
-    `1. output \`cat "$HANOMAN_PHASE_FILE"\` yang memuat satu baris untuk SETIAP fase ${phases2.join(" \u2192 ")}, masing-masing berakhiran \`done\` atau \`skipped\`` + phases2.filter((p3) => UNSKIPPABLE_PHASES.has(p3)).map((p3) => ` (\`${p3}\` wajib \`done\`)`).join("") + ";"
+    `1. output \`cat "$HANOMAN_PHASE_FILE"\` yang memuat satu baris untuk SETIAP fase ${phases2.join(" \u2192 ")}, masing-masing berakhiran \`done\` atau \`skipped\`` + phases2.filter((p3) => UNSKIPPABLE_PHASES.has(p3)).map((p3) => ` (\`${p3}\` wajib \`done\`)`).join("") + phases2.filter((p3) => OPTIONAL_PHASES.has(p3)).map((p3) => ` (\`${p3}\` boleh tanpa baris bila fase sesudahnya sudah tercatat)`).join("") + ";"
   ];
   if (planGate) {
     const dirs = PLAN_DIRS.map((d) => `${d}/`).join(" ");
@@ -18133,12 +18202,13 @@ function codexGoalScript(o) {
     `ST=${shq(o.stateFile)}`,
     "missing=''"
   ];
-  for (const p3 of phases2) {
+  phases2.forEach((p3, i) => {
+    const name2 = OPTIONAL_PHASES.has(p3) ? `(${phases2.slice(i).join("|")})` : p3;
     lines2.push(
       // ADR-0230 · fase `UNSKIPPABLE_PHASES` (Review) hanya lolos dengan `done`.
-      `grep -qE ${shq(`^${p3} ${UNSKIPPABLE_PHASES.has(p3) ? "done" : "(done|skipped)"}[[:space:]]*$`)} "$PF" 2>/dev/null || missing="$missing\\n- fase ${p3} belum tercatat di \\$HANOMAN_PHASE_FILE"`
+      `grep -qE ${shq(`^${name2} ${UNSKIPPABLE_PHASES.has(p3) ? "done" : "(done|skipped)"}[[:space:]]*$`)} "$PF" 2>/dev/null || missing="$missing\\n- fase ${p3} belum tercatat di \\$HANOMAN_PHASE_FILE"`
     );
-  }
+  });
   if (planGate) {
     for (const dir2 of PLAN_DIRS) {
       lines2.push(
@@ -18891,9 +18961,16 @@ function backlogGuide(flow2, phase, ctx) {
     // default skill) lolos hampa. Nama dikunci seperti Brainstorm, dan path persisnya diteruskan
     // orchestrator ke Execute & reviewer — bukan pola glob yang bisa mencocoki plan backlog lain.
     case "Plan":
-      return `- Plan: tulis plan implementasi berkotak \`- [ ]\` untuk backlog ini dari dokumen spec-nya (path di serah-terima) ke SATU berkas \`${m.planDir}/<YYYY-MM-DD>-<spec-id>-<slug>.md\` (spec-id backlog ini huruf kecil, mis. \`2026-09-25-spec-123-ekspor-csv.md\` \u2014 nama tanpa spec-id membuat hanoman tak menemukan plan-nya). Laporkan path PERSIS berkas itu di \`Artefak:\`; orchestrator meneruskannya ke Execute. ${PLAN_SHAPE}`;
+      return `- Plan: tulis plan implementasi berkotak \`- [ ]\` untuk backlog ini dari dokumen spec-nya (path di serah-terima) ke SATU berkas \`${m.planDir}/<YYYY-MM-DD>-<spec-id>-<slug>.md\` (spec-id backlog ini huruf kecil, mis. \`2026-09-25-spec-123-ekspor-csv.md\` \u2014 nama tanpa spec-id membuat hanoman tak menemukan plan-nya). Laporkan path PERSIS berkas itu di \`Artefak:\`; orchestrator meneruskannya ke Execute. ${PLAN_SHAPE} ${MOCKUP_FOLLOW_UP.Plan}`;
     case "Execute":
-      return `- Execute: kerjakan plan backlog ini \u2014 path persisnya di baris \`Artefak fase sebelumnya:\` serah-terima (bila tak ada: berkas di \`${m.planDir}/\` yang namanya memuat spec-id backlog ini). Execute BELUM selesai selama plan masih punya task \`- [ ]\`: kerjakan SEMUA task sampai tiap kotak jadi \`- [x]\` sebelum melapor \`Status: selesai\`. hanoman menahan backlog di \`executing\`, bukan \`done\`, selama masih ada \`- [ ]\`. Laporan \`Status: selesai\` wajib memuat tabel \`AC \u2192 bukti\`: setiap acceptance criteria dokumen spec (qa jalur-cepat: dokumen audit) \u2192 perintah yang kamu jalankan beserta hasil yang kamu baca, atau path:baris yang membuktikannya. AC tanpa bukti = belum selesai; laporanmu diperiksa ulang sebelum fase ditutup.`;
+      return `- Execute: kerjakan plan backlog ini \u2014 path persisnya di baris \`Artefak fase sebelumnya:\` serah-terima (bila tak ada: berkas di \`${m.planDir}/\` yang namanya memuat spec-id backlog ini). Execute BELUM selesai selama plan masih punya task \`- [ ]\`: kerjakan SEMUA task sampai tiap kotak jadi \`- [x]\` sebelum melapor \`Status: selesai\`. hanoman menahan backlog di \`executing\`, bukan \`done\`, selama masih ada \`- [ ]\`. Laporan \`Status: selesai\` wajib memuat tabel \`AC \u2192 bukti\`: setiap acceptance criteria dokumen spec (qa jalur-cepat: dokumen audit) \u2192 perintah yang kamu jalankan beserta hasil yang kamu baca, atau path:baris yang membuktikannya. AC tanpa bukti = belum selesai; laporanmu diperiksa ulang sebelum fase ditutup. ${MOCKUP_FOLLOW_UP.Execute}`;
+    // ADR-0233 · panduan yang SAMA dengan sesi tunggal (`mockupGuide`); bedanya cuma jalur tanya & penutupan:
+    // agen fase tak bisa bertanya langsung dan tak menulis marker sendiri.
+    case "Mockup":
+      return "- Mockup: " + mockupGuide(
+        "sebagai butir `Keputusan terbuka:` laporanmu (`Status: menunggu-keputusan`) \u2014 orchestrator yang menanyakannya",
+        "Disetujui & di-commit \u2192 `Status: selesai`. Dilewati (tanpa UI, atau dipilih Lewati) \u2192 `Status: selesai` dengan `Rekomendasi fase: lewati` beserta alasannya; orchestrator yang menulis marker-nya."
+      );
     case "Audit":
       return flow2 === "audit" ? "- Audit: ini audit-only \u2014 investigasi SAJA, JANGAN menulis perbaikan kode apa pun. Telusuri akar masalah / log / jawaban dan nilai apakah issue terdefinisi dengan baik. Laporkan temuan beserta buktinya; dokumennya ditulis fase Laporan." : "- Audit: telusuri akar masalah dengan bukti (reproduksi, log, kode) dan tulis dokumen audit ke `internal/docs/research/audit-<spec-id>-<slug>.md`. Lalu putuskan jalurnya dari hasil Audit, bukan default: bila temuan berconfidence tinggi dan perbaikannya bisa dikerjakan langsung (diff kecil, akar masalah jelas), tulis `Rekomendasi fase: jalur-cepat` beserta alasannya \u2014 orchestrator akan melewati Spec & Plan dan dokumen audit menjadi doc-of-record perbaikan itu. Bila temuan luas, berisiko, atau ambigu, tulis `Rekomendasi fase: penuh`. " + FRONT_LOADED_DECISIONS("Spec, Plan, dan Execute") + " Catat jawabannya di dokumen audit.";
     case "Laporan":
@@ -18971,7 +19048,7 @@ function reviewerInstructions(plan, ctx) {
     "Prosedur:",
     [
       `1. Baca dokumen spec & plan dari baris \`Artefak:\` serah-terima (qa jalur-cepat: dokumen audit adalah doc-of-record; bila path tak ada, cari berkas ber-spec-id di \`${m.specDir}/\` & \`${m.planDir}/\`). Plan yang menyimpang dari spec adalah temuan.`,
-      "2. Ubah acceptance criteria jadi daftar yang diperiksa SATU PER SATU. Kalimat tak terukur ditandai tak terukur, bukan ditafsirkan.",
+      "2. Ubah acceptance criteria jadi daftar yang diperiksa SATU PER SATU. Kalimat tak terukur ditandai tak terukur, bukan ditafsirkan. Bila `docs/mockups/<spec-id>/` ada, kesesuaian UI hasil dengan mockup yang disetujui ikut jadi kriteria.",
       '3. Baca `git diff "$HANOMAN_BASE_SHA"...HEAD` dan `git status --porcelain` (perubahan belum di-commit adalah temuan). Laporan Execute dan kotak `- [x]` hanyalah klaim.',
       "4. Jalankan test yang relevan dengan berkas yang berubah, sesuai scope verifikasi di bawah, dan baca outputnya sendiri.",
       `5. Per kriteria putuskan salah satu: ${SPEC_AUDIT_VERDICT_LIST}. Kriteria tanpa jangkar di diff bukan otomatis gagal \u2014 cari bukti keadaan akhir; tak bisa dibuktikan \u2192 belum terverifikasi.`
@@ -20971,6 +21048,7 @@ __export(src_exports, {
   GOAL_MAX: () => GOAL_MAX,
   GOAL_MAX_BLOCKS: () => GOAL_MAX_BLOCKS,
   GOAL_TUI_PASTE_LIMIT: () => GOAL_TUI_PASTE_LIMIT,
+  MOCKUP_FOLLOW_UP: () => MOCKUP_FOLLOW_UP,
   PHASE_CONTEXT_HEADER: () => PHASE_CONTEXT_HEADER,
   PIPELINES: () => PIPELINES,
   PLAN_SHAPE: () => PLAN_SHAPE,
@@ -21037,6 +21115,7 @@ __export(src_exports, {
   materializeAntigravityAgents: () => materializeAntigravityAgents,
   materializeCodexAgents: () => materializeCodexAgents,
   methodClause: () => methodClause,
+  mockupGuide: () => mockupGuide,
   orchestratorClause: () => orchestratorClause,
   parseConfigEnv: () => parseConfigEnv,
   phaseAgentInstructions: () => phaseAgentInstructions,
@@ -21509,10 +21588,13 @@ var init_session_phases = __esm({
     decisionFilePath = (repoDir, sessionId2) => `${repoDir}/.worktrees/.decisions/${sessionId2}`;
     phaseFileMemo = /* @__PURE__ */ new Map();
     derivePhases = (seen2, flow2) => {
+      const names = PIPELINES[flow2];
       let activeTaken = false;
-      return PIPELINES[flow2].map((name2) => {
+      return names.map((name2, i) => {
         const state = seen2.get(name2);
         if (state) return { name: name2, state };
+        if (OPTIONAL_PHASES.has(name2) && names.slice(i + 1).some((later) => seen2.has(later)))
+          return { name: name2, state: "skipped" };
         if (activeTaken) return { name: name2, state: "pending" };
         activeTaken = true;
         return { name: name2, state: "active" };
@@ -21793,18 +21875,146 @@ var init_antigravity_runtime = __esm({
   }
 });
 
+// src/runner/deps.ts
+import { existsSync as existsSync9 } from "node:fs";
+import { dirname as dirname10, join as join15 } from "node:path";
+function repoRootFrom(startDir) {
+  let dir2 = startDir;
+  for (let i = 0; i < 8; i++) {
+    if (existsSync9(join15(dir2, "pnpm-workspace.yaml"))) return dir2;
+    const parent = dirname10(dir2);
+    if (parent === dir2) break;
+    dir2 = parent;
+  }
+  return startDir;
+}
+var repoRoot;
+var init_deps = __esm({
+  "src/runner/deps.ts"() {
+    "use strict";
+    repoRoot = (startDir = process.cwd()) => repoRootFrom(startDir);
+  }
+});
+
+// src/services/bundled-skills.ts
+import { createHash as createHash7 } from "node:crypto";
+import { chmodSync as chmodSync7, cpSync as cpSync3, existsSync as existsSync10, mkdirSync as mkdirSync9, readFileSync as readFileSync11, readdirSync as readdirSync8, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync3, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join16, relative as relative5, sep as sep6 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+function bundledSkillsDir() {
+  const packed = packagedDir();
+  return existsSync10(packed) ? packed : join16(repoRoot(moduleDir()), "server", "skills");
+}
+function filesUnder(dir2) {
+  const out4 = [];
+  const walk = (d) => {
+    for (const n2 of readdirSync8(d).sort()) {
+      if (n2 === BUNDLED_MARKER || n2 === ".DS_Store") continue;
+      const full = join16(d, n2);
+      if (statSync3(full).isDirectory()) walk(full);
+      else out4.push(full);
+    }
+  };
+  walk(dir2);
+  return out4;
+}
+function contentSha(dir2) {
+  const h2 = createHash7("sha256");
+  for (const f of filesUnder(dir2)) {
+    h2.update(relative5(dir2, f).split(sep6).join("/"));
+    h2.update("\0");
+    h2.update(readFileSync11(f));
+    h2.update("\0");
+  }
+  return h2.digest("hex");
+}
+function markerSha(dir2) {
+  try {
+    const parsed = JSON.parse(readFileSync11(join16(dir2, BUNDLED_MARKER), "utf8"));
+    const sha2 = parsed?.sha;
+    return typeof sha2 === "string" ? sha2 : null;
+  } catch {
+    return null;
+  }
+}
+function install(src, dest, sha2) {
+  const tmp = `${dest}.tmp-${process.pid}`;
+  rmSync6(tmp, { recursive: true, force: true });
+  cpSync3(src, tmp, { recursive: true });
+  for (const f of filesUnder(tmp))
+    if (relative5(tmp, f).split(sep6)[0] === "scripts") chmodSync7(f, statSync3(f).mode | 493);
+  writeFileSync11(join16(tmp, BUNDLED_MARKER), `${JSON.stringify({ sha: sha2, seededAt: (/* @__PURE__ */ new Date()).toISOString() })}
+`);
+  rmSync6(dest, { recursive: true, force: true });
+  renameSync4(tmp, dest);
+}
+function seedBundledSkills(hanomanHome, o = {}) {
+  const out4 = { seeded: [], updated: [], kept: [] };
+  const source = o.source ?? bundledSkillsDir();
+  const log = o.log ?? ((m) => console.warn(m));
+  const names = skillDirsIn(source);
+  if (!names.length) return out4;
+  const root = hanomanSkillsDir(hanomanHome);
+  for (const name2 of names) {
+    try {
+      const src = join16(source, name2);
+      const dest = join16(root, name2);
+      const bundleSha = contentSha(src);
+      if (!existsSync10(dest)) {
+        mkdirSync9(root, { recursive: true });
+        install(src, dest, bundleSha);
+        out4.seeded.push(name2);
+        continue;
+      }
+      const recorded2 = markerSha(dest);
+      if (recorded2 === bundleSha) continue;
+      if (recorded2 === null || contentSha(dest) !== recorded2) {
+        out4.kept.push(name2);
+        log(`skill bundel ${name2} tak diperbarui: salinan di ${dest} milik operator (tanpa marker atau sudah disunting)`);
+        continue;
+      }
+      install(src, dest, bundleSha);
+      out4.updated.push(name2);
+    } catch (e) {
+      log(`skill bundel ${name2} gagal di-seed: ${e.message}`);
+    }
+  }
+  return out4;
+}
+var BUNDLED_MARKER, packagedDir, moduleDir, skillDirsIn, isBundledCopy;
+var init_bundled_skills = __esm({
+  "src/services/bundled-skills.ts"() {
+    "use strict";
+    init_src2();
+    init_deps();
+    BUNDLED_MARKER = ".hanoman-bundled.json";
+    packagedDir = () => fileURLToPath3(new URL("../skills", import.meta.url));
+    moduleDir = () => fileURLToPath3(new URL(".", import.meta.url));
+    skillDirsIn = (source) => {
+      let names;
+      try {
+        names = readdirSync8(source);
+      } catch {
+        return [];
+      }
+      return names.filter((n2) => !n2.startsWith(".") && existsSync10(join16(source, n2, "SKILL.md"))).sort();
+    };
+    isBundledCopy = (dir2) => existsSync10(join16(dir2, BUNDLED_MARKER));
+  }
+});
+
 // src/services/skill-inject.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { createHash as createHash7 } from "node:crypto";
-import { appendFileSync as appendFileSync2, existsSync as existsSync9, lstatSync as lstatSync7, mkdirSync as mkdirSync9, readFileSync as readFileSync11, readlinkSync as readlinkSync2, symlinkSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync11 } from "node:fs";
-import { isAbsolute as isAbsolute8, join as join15 } from "node:path";
+import { createHash as createHash8 } from "node:crypto";
+import { appendFileSync as appendFileSync2, existsSync as existsSync11, lstatSync as lstatSync7, mkdirSync as mkdirSync10, readFileSync as readFileSync12, readlinkSync as readlinkSync2, symlinkSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync12 } from "node:fs";
+import { isAbsolute as isAbsolute8, join as join17 } from "node:path";
 function excludeFile(repoDir) {
   const common = execFileSync4("git", ["rev-parse", "--git-common-dir"], { cwd: repoDir, env: agentEnvironment(null, process.env), encoding: "utf8" }).trim();
-  return join15(isAbsolute8(common) ? common : join15(repoDir, common), "info", "exclude");
+  return join17(isAbsolute8(common) ? common : join17(repoDir, common), "info", "exclude");
 }
 function ownedSkills(tempDir) {
   try {
-    const parsed = JSON.parse(readFileSync11(manifestPath(tempDir), "utf8"));
+    const parsed = JSON.parse(readFileSync12(manifestPath(tempDir), "utf8"));
     return Array.isArray(parsed) ? parsed.filter((row) => row && typeof row.link === "string" && typeof row.target === "string" && typeof row.exclude === "string" && typeof row.pair === "string" && typeof row.ino === "number" && typeof row.dev === "number") : [];
   } catch {
     return [];
@@ -21817,8 +22027,8 @@ function cleanupInjectedSkills(tempDir) {
       if (!st2.isSymbolicLink() || st2.ino !== own.ino || st2.dev !== own.dev || readlinkSync2(own.link) !== own.target) continue;
       unlinkSync2(own.link);
       if (own.pair) {
-        const bytes = readFileSync11(own.exclude, "utf8");
-        if (bytes.includes(own.pair)) writeFileSync11(own.exclude, bytes.replace(own.pair, ""));
+        const bytes = readFileSync12(own.exclude, "utf8");
+        if (bytes.includes(own.pair)) writeFileSync12(own.exclude, bytes.replace(own.pair, ""));
       }
     } catch {
     }
@@ -21826,18 +22036,20 @@ function cleanupInjectedSkills(tempDir) {
 }
 function injectGlobalSkills(o) {
   const out4 = { injected: [], warnings: [] };
-  const opts2 = { hanomanHome: o.hanomanHome, env: process.env };
-  const global2 = scanGlobalSkills(opts2).filter((s2) => s2.layer === "hanoman");
+  const opts2 = { hanomanHome: o.hanomanHome, env: process.env, ...o.osHome ? { osHome: o.osHome } : {} };
+  const scanned = scanGlobalSkills(opts2);
+  const global2 = scanned.filter((s2) => s2.layer === "hanoman");
   if (!global2.length) return out4;
   const taken = new Set(scanProjectSkills("session", o.cwd, opts2).map((s2) => s2.name));
-  const todo = global2.filter((s2) => !taken.has(s2.name));
+  const userOwned = new Set(scanned.filter((s2) => s2.layer === "user" && s2.loadedBy.includes(o.agent)).map((s2) => s2.name));
+  const todo = global2.filter((s2) => !taken.has(s2.name) && !(userOwned.has(s2.name) && isBundledCopy(s2.dir)));
   if (!todo.length) return out4;
   if (o.agent === "claude") {
-    const root = join15(o.tempDir, "skills-root");
+    const root = join17(o.tempDir, "skills-root");
     try {
-      mkdirSync9(join15(root, ".claude", "skills"), { recursive: true });
+      mkdirSync10(join17(root, ".claude", "skills"), { recursive: true });
       for (const s2 of todo) {
-        const link2 = join15(root, ".claude", "skills", s2.name);
+        const link2 = join17(root, ".claude", "skills", s2.name);
         if (!lstatSync7(link2, { throwIfNoEntry: false })) symlinkSync(s2.dir, link2);
         out4.injected.push(s2.name);
       }
@@ -21858,25 +22070,25 @@ function injectGlobalSkills(o) {
     let ownedLink;
     let ownedPair = "";
     try {
-      const link2 = join15(o.cwd, ".agents", "skills", s2.name);
+      const link2 = join17(o.cwd, ".agents", "skills", s2.name);
       if (o.agent === "antigravity") {
-        for (const dir2 of [join15(o.cwd, ".agents"), join15(o.cwd, ".agents", "skills")]) {
+        for (const dir2 of [join17(o.cwd, ".agents"), join17(o.cwd, ".agents", "skills")]) {
           const st2 = lstatSync7(dir2, { throwIfNoEntry: false });
           if (st2 && (!st2.isDirectory() || st2.isSymbolicLink())) throw new Error("akar skill bukan direktori aman");
         }
       }
       if (lstatSync7(link2, { throwIfNoEntry: false })) continue;
-      mkdirSync9(join15(o.cwd, ".agents", "skills"), { recursive: true });
+      mkdirSync10(join17(o.cwd, ".agents", "skills"), { recursive: true });
       symlinkSync(s2.dir, link2);
       ownedLink = link2;
-      mkdirSync9(join15(exclude, ".."), { recursive: true });
-      const cur = existsSync9(exclude) ? readFileSync11(exclude, "utf8") : "";
+      mkdirSync10(join17(exclude, ".."), { recursive: true });
+      const cur = existsSync11(exclude) ? readFileSync12(exclude, "utf8") : "";
       const line = excludeLine(s2.name);
       const lines2 = cur.split("\n");
       const hasOperatorLine = lines2.some((entry2, index) => entry2 === line && !lines2[index - 1]?.startsWith(`${INJECT_MARKER}:antigravity:`));
       if (o.agent === "antigravity" ? !hasOperatorLine : !lines2.includes(line)) {
         if (o.agent === "antigravity") {
-          const hash4 = createHash7("sha256").update(`${link2}\0${s2.dir}`).digest("hex");
+          const hash4 = createHash8("sha256").update(`${link2}\0${s2.dir}`).digest("hex");
           ownedPair = `${INJECT_MARKER}:antigravity:${hash4}
 ${line}
 `;
@@ -21889,9 +22101,9 @@ ${line}
         }
       }
       if (o.agent === "antigravity") {
-        mkdirSync9(o.tempDir, { recursive: true, mode: 448 });
+        mkdirSync10(o.tempDir, { recursive: true, mode: 448 });
         const st2 = lstatSync7(link2);
-        writeFileSync11(manifestPath(o.tempDir), JSON.stringify([...ownedSkills(o.tempDir), { link: link2, target: s2.dir, exclude, pair: ownedPair, ino: st2.ino, dev: st2.dev }]), { mode: 384 });
+        writeFileSync12(manifestPath(o.tempDir), JSON.stringify([...ownedSkills(o.tempDir), { link: link2, target: s2.dir, exclude, pair: ownedPair, ino: st2.ino, dev: st2.dev }]), { mode: 384 });
       }
       out4.injected.push(s2.name);
     } catch (e) {
@@ -21901,7 +22113,7 @@ ${line}
         } catch {
         }
         try {
-          if (ownedPair) writeFileSync11(exclude, readFileSync11(exclude, "utf8").replace(ownedPair, ""));
+          if (ownedPair) writeFileSync12(exclude, readFileSync12(exclude, "utf8").replace(ownedPair, ""));
         } catch {
         }
       }
@@ -21913,9 +22125,9 @@ ${line}
 function unexcludeInjected(repoDir, name2) {
   try {
     const f = excludeFile(repoDir);
-    if (!existsSync9(f)) return;
+    if (!existsSync11(f)) return;
     const line = excludeLine(name2);
-    writeFileSync11(f, readFileSync11(f, "utf8").split("\n").filter((l) => l !== line).join("\n"));
+    writeFileSync12(f, readFileSync12(f, "utf8").split("\n").filter((l) => l !== line).join("\n"));
   } catch {
   }
 }
@@ -21924,17 +22136,18 @@ var init_skill_inject = __esm({
   "src/services/skill-inject.ts"() {
     "use strict";
     init_src2();
+    init_bundled_skills();
     INJECT_MARKER = "# hanoman:skill-inject";
     excludeLine = (name2) => `/.agents/skills/${name2}`;
-    manifestPath = (tempDir) => join15(tempDir, "antigravity-skills.json");
+    manifestPath = (tempDir) => join17(tempDir, "antigravity-skills.json");
   }
 });
 
 // src/services/antigravity-trust.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { closeSync as closeSync2, lstatSync as lstatSync8, mkdirSync as mkdirSync10, openSync as openSync2, readFileSync as readFileSync12, realpathSync as realpathSync6, renameSync as renameSync4, unlinkSync as unlinkSync3, writeFileSync as writeFileSync12 } from "node:fs";
+import { closeSync as closeSync2, lstatSync as lstatSync8, mkdirSync as mkdirSync11, openSync as openSync2, readFileSync as readFileSync13, realpathSync as realpathSync6, renameSync as renameSync5, unlinkSync as unlinkSync3, writeFileSync as writeFileSync13 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join16 } from "node:path";
+import { join as join18 } from "node:path";
 function safeOwned(path, directory) {
   const st2 = lstatSync8(path);
   if (st2.isSymbolicLink() || (directory ? !st2.isDirectory() : !st2.isFile()) || process.getuid && st2.uid !== process.getuid()) throw new Error("unsafe path");
@@ -21944,18 +22157,18 @@ function ensureAntigravityTrust(cwd, home3 = homedir4()) {
   let fd;
   try {
     const canonical = realpathSync6(cwd);
-    mkdirSync10(home3, { recursive: true });
+    mkdirSync11(home3, { recursive: true });
     const root = realpathSync6(home3);
-    for (const dir2 of [join16(root, ".gemini"), join16(root, ".gemini", "antigravity-cli")]) {
-      if (!lstatSync8(dir2, { throwIfNoEntry: false })) mkdirSync10(dir2, { mode: 448 });
+    for (const dir2 of [join18(root, ".gemini"), join18(root, ".gemini", "antigravity-cli")]) {
+      if (!lstatSync8(dir2, { throwIfNoEntry: false })) mkdirSync11(dir2, { mode: 448 });
       safeOwned(dir2, true);
     }
-    const file = join16(root, ".gemini", "antigravity-cli", "settings.json");
+    const file = join18(root, ".gemini", "antigravity-cli", "settings.json");
     const original = lstatSync8(file, { throwIfNoEntry: false });
     let settings = {};
     if (original) {
       safeOwned(file, false);
-      const parsed = JSON.parse(readFileSync12(file, "utf8"));
+      const parsed = JSON.parse(readFileSync13(file, "utf8"));
       if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("invalid settings");
       settings = parsed;
     }
@@ -21967,14 +22180,14 @@ function ensureAntigravityTrust(cwd, home3 = homedir4()) {
     const candidate = `${file}.${randomUUID2()}.tmp`;
     fd = openSync2(candidate, "wx", 384);
     temp = candidate;
-    writeFileSync12(fd, `${JSON.stringify({ ...settings, trustedWorkspaces: [...workspaces, canonical] }, null, 2)}
+    writeFileSync13(fd, `${JSON.stringify({ ...settings, trustedWorkspaces: [...workspaces, canonical] }, null, 2)}
 `);
     closeSync2(fd);
     fd = void 0;
     const latest = lstatSync8(file, { throwIfNoEntry: false });
     if (original ? !latest || latest.ino !== original.ino || latest.mtimeMs !== original.mtimeMs : latest)
       throw new Error("settings changed during preparation");
-    renameSync4(temp, file);
+    renameSync5(temp, file);
     temp = void 0;
   } catch {
     throw new Error("antigravity-trust-preparation-failed");
@@ -22024,14 +22237,14 @@ var init_local_binding = __esm({
 });
 
 // src/services/skill-library.ts
-import { join as join17 } from "node:path";
-import { existsSync as existsSync10 } from "node:fs";
+import { join as join19 } from "node:path";
+import { existsSync as existsSync12 } from "node:fs";
 async function libraryAll() {
   const global2 = scanGlobalSkills(opts());
   const projects = await prisma.project.findMany({ orderBy: { name: "asc" }, select: { id: true, name: true } });
   const groups = await Promise.all(projects.map(async (p3) => {
     const repo = await resolveRepoDir(p3.id);
-    if (!repo || !existsSync10(repo)) return { projectId: p3.id, name: p3.name, skills: [], error: "repo tidak ditemukan" };
+    if (!repo || !existsSync12(repo)) return { projectId: p3.id, name: p3.name, skills: [], error: "repo tidak ditemukan" };
     return { projectId: p3.id, name: p3.name, skills: scanProjectSkills(p3.id, repo, opts()) };
   }));
   return { global: global2, projects: groups };
@@ -22054,17 +22267,17 @@ async function targetParent(layer, source, projectId) {
   if (layer === "user") {
     const s2 = source ?? ".claude";
     if (!USER_SOURCES.includes(s2)) throw new SkillError(400, "source user harus .claude/.codex/.agents/.gemini/antigravity-cli");
-    if (s2 === ".agents") return join17(agentsSkillHome(process.env), "skills");
-    if (s2 === ".gemini/antigravity-cli") return join17(agentSkillHome("antigravity", process.env), "skills");
-    return join17(agentSkillHome(s2 === ".codex" ? "codex" : "claude", process.env), "skills");
+    if (s2 === ".agents") return join19(agentsSkillHome(process.env), "skills");
+    if (s2 === ".gemini/antigravity-cli") return join19(agentSkillHome("antigravity", process.env), "skills");
+    return join19(agentSkillHome(s2 === ".codex" ? "codex" : "claude", process.env), "skills");
   }
   if (layer === "project") {
     if (!projectId) throw new SkillError(400, "projectId wajib untuk lapis project");
     const s2 = source ?? ".claude";
     if (!PROJECT_SOURCES.includes(s2)) throw new SkillError(400, "source project harus .claude/.agents/.codex");
     const repo = await resolveRepoDir(projectId);
-    if (!repo || !existsSync10(repo)) throw new SkillError(404, "repo project tidak ditemukan");
-    return join17(repo, s2, "skills");
+    if (!repo || !existsSync12(repo)) throw new SkillError(404, "repo project tidak ditemukan");
+    return join19(repo, s2, "skills");
   }
   throw new SkillError(400, "layer harus hanoman, user, atau project");
 }
@@ -35867,7 +36080,7 @@ var require_snapshot_utils = __commonJS({
 var require_snapshot_recorder = __commonJS({
   "../node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/mock/snapshot-recorder.js"(exports, module) {
     "use strict";
-    var { writeFile: writeFile9, readFile: readFile11, mkdir: mkdir13 } = __require("node:fs/promises");
+    var { writeFile: writeFile9, readFile: readFile12, mkdir: mkdir13 } = __require("node:fs/promises");
     var { dirname: dirname20, resolve: resolve25 } = __require("node:path");
     var { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = __require("node:timers");
     var { InvalidArgumentError, UndiciError } = require_errors();
@@ -36069,7 +36282,7 @@ var require_snapshot_recorder = __commonJS({
           throw new InvalidArgumentError("Snapshot path is required");
         }
         try {
-          const data = await readFile11(resolve25(path), "utf8");
+          const data = await readFile12(resolve25(path), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -47920,7 +48133,7 @@ ${captureLines}` : capture.stack;
     module.exports.mockErrors = mockErrors;
     var { EventSource } = require_eventsource();
     module.exports.EventSource = EventSource;
-    function install() {
+    function install2() {
       globalThis.fetch = module.exports.fetch;
       globalThis.Headers = module.exports.Headers;
       globalThis.Response = module.exports.Response;
@@ -47932,7 +48145,7 @@ ${captureLines}` : capture.stack;
       globalThis.MessageEvent = module.exports.MessageEvent;
       globalThis.EventSource = module.exports.EventSource;
     }
-    module.exports.install = install;
+    module.exports.install = install2;
   }
 });
 
@@ -48178,7 +48391,7 @@ var init_safe_outbound_request = __esm({
 // src/services/uploads.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { mkdir, writeFile, readFile as readFile2, unlink, rm } from "node:fs/promises";
-import { join as join18, resolve as resolve9 } from "node:path";
+import { join as join20, resolve as resolve9 } from "node:path";
 function extFor(mimeType) {
   return EXT[mimeType] ?? ".bin";
 }
@@ -48189,17 +48402,17 @@ async function saveUpload(buf, mimeType) {
   const dir2 = uploadDir();
   await mkdir(dir2, { recursive: true, mode: 448 });
   const storageKey = `${randomUUID3()}${extFor(mimeType)}`;
-  await writeFile(join18(dir2, storageKey), buf, { mode: 384 });
+  await writeFile(join20(dir2, storageKey), buf, { mode: 384 });
   return { storageKey, size: buf.length };
 }
 function sessionUploadDir(sessionId2) {
   if (!SESSION_ID.test(sessionId2)) throw new Error(`sessionId tak sah: ${sessionId2}`);
-  return join18(uploadDir(), "terminal", sessionId2);
+  return join20(uploadDir(), "terminal", sessionId2);
 }
 async function saveSessionUpload(sessionId2, buf, mimeType) {
   const dir2 = sessionUploadDir(sessionId2);
   await mkdir(dir2, { recursive: true, mode: 448 });
-  const path = join18(dir2, `${randomUUID3()}${extFor(mimeType)}`);
+  const path = join20(dir2, `${randomUUID3()}${extFor(mimeType)}`);
   await writeFile(path, buf, { mode: 384 });
   return { path, size: buf.length };
 }
@@ -48215,11 +48428,11 @@ async function dropSessionUploads(sessionId2) {
 }
 async function readUpload(storageKey) {
   const safe3 = storageKey.replace(/[/\\]/g, "");
-  return readFile2(join18(uploadDir(), safe3));
+  return readFile2(join20(uploadDir(), safe3));
 }
 async function readUploadOrFetch(storageKey) {
   const safe3 = storageKey.replace(/[/\\]/g, "");
-  const target3 = join18(uploadDir(), safe3);
+  const target3 = join20(uploadDir(), safe3);
   try {
     return await readFile2(target3);
   } catch {
@@ -48246,7 +48459,7 @@ async function readUploadOrFetch(storageKey) {
 }
 async function deleteUpload(storageKey) {
   const safe3 = storageKey.replace(/[/\\]/g, "");
-  await unlink(join18(uploadDir(), safe3)).catch(() => {
+  await unlink(join20(uploadDir(), safe3)).catch(() => {
   });
 }
 var EXT, SESSION_ID;
@@ -48689,14 +48902,14 @@ var init_session_sandbox = __esm({
 });
 
 // src/services/session-event-spool.ts
-import { join as join19 } from "node:path";
+import { join as join21 } from "node:path";
 var sessionEventSpoolRoot, sessionEventDir;
 var init_session_event_spool = __esm({
   "src/services/session-event-spool.ts"() {
     "use strict";
     init_src2();
-    sessionEventSpoolRoot = (env = process.env) => join19(resolveHome(env), "session-events");
-    sessionEventDir = (sessionId2, env = process.env) => join19(sessionEventSpoolRoot(env), sessionId2);
+    sessionEventSpoolRoot = (env = process.env) => join21(resolveHome(env), "session-events");
+    sessionEventDir = (sessionId2, env = process.env) => join21(sessionEventSpoolRoot(env), sessionId2);
   }
 });
 
@@ -48720,9 +48933,9 @@ import { spawn } from "node-pty";
 import { execFile as execFile2, execFileSync as execFileSync5 } from "node:child_process";
 import { createRequire } from "node:module";
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { chmodSync as chmodSync7, mkdirSync as mkdirSync11, readFileSync as readFileSync13, rmSync as rmSync6, statSync as statSync3, writeFileSync as writeFileSync13 } from "node:fs";
+import { chmodSync as chmodSync8, mkdirSync as mkdirSync12, readFileSync as readFileSync14, rmSync as rmSync7, statSync as statSync4, writeFileSync as writeFileSync14 } from "node:fs";
 import { stat as stat2 } from "node:fs/promises";
-import { dirname as dirname10, resolve as resolvePath } from "node:path";
+import { dirname as dirname11, resolve as resolvePath } from "node:path";
 import { tmpdir as tmpdir4 } from "node:os";
 function doneSeenOf(id2) {
   const known2 = phaseDoneSeen.get(id2);
@@ -48783,8 +48996,8 @@ function fitCustomAgentsToArgBudget(customDefs, render, limit = AGENTS_ARG_SAFE_
 }
 function noTtyPromptEnv() {
   const path = askpassDenyPath();
-  mkdirSync11(dirname10(path), { recursive: true, mode: 448 });
-  writeFileSync13(path, ASKPASS_DENY, { mode: 448 });
+  mkdirSync12(dirname11(path), { recursive: true, mode: 448 });
+  writeFileSync14(path, ASKPASS_DENY, { mode: 448 });
   return { SSH_ASKPASS: path, SSH_ASKPASS_REQUIRE: "force", GIT_TERMINAL_PROMPT: "0" };
 }
 function hanomanDbInheritUnsets(env = process.env) {
@@ -49037,8 +49250,8 @@ function createSession(projectId, cwd, opts2 = {}) {
   phaseDoneSeen.delete(id2);
   const eventDir = opts2.command ? void 0 : sessionEventDir(id2);
   if (eventDir) {
-    mkdirSync11(eventDir, { recursive: true, mode: 448 });
-    chmodSync7(eventDir, 448);
+    mkdirSync12(eventDir, { recursive: true, mode: 448 });
+    chmodSync8(eventDir, 448);
   }
   const agentForDefs = opts2.agent ?? "claude";
   const sessionEffort = agentForDefs === "codex" && opts2.model && opts2.effort ? coerceCodexEffort(opts2.model, opts2.effort) : opts2.effort;
@@ -49082,7 +49295,7 @@ function createSession(projectId, cwd, opts2 = {}) {
   if (customDefs.length > 0 || requestedPhaseDefs.length > 0) {
     const tempDir = agentTempDir(id2);
     agentConfigDir = tempDir;
-    mkdirSync11(tempDir, { recursive: true, mode: 448 });
+    mkdirSync12(tempDir, { recursive: true, mode: 448 });
     let hook;
     const readOnlyHookFor = () => customDefs.some((def2) => def2.workspacePolicy === "read-only") ? hook ??= writeReadOnlyHook(tempDir) : void 0;
     const attempt = (requested) => {
@@ -49097,16 +49310,16 @@ function createSession(projectId, cwd, opts2 = {}) {
           let phaseContextFile;
           if (shared !== void 0) {
             const path = phaseContextFilePath(id2);
-            writeFileSync13(path, shared, { mode: 384 });
-            chmodSync7(path, 384);
+            writeFileSync14(path, shared, { mode: 384 });
+            chmodSync8(path, 384);
             phaseContextFile = { context: shared, path };
           }
           const agentContractFiles = [];
           for (const policy of new Set(customDefs.map((d) => d.workspacePolicy ?? "inherit"))) {
             const path = agentContractFilePath(id2, policy);
             const content = agentContractOf(policy);
-            writeFileSync13(path, content, { mode: 384 });
-            chmodSync7(path, 384);
+            writeFileSync14(path, content, { mode: 384 });
+            chmodSync8(path, 384);
             agentContractFiles.push({ policy, content, path });
           }
           const fit = fitCustomAgentsToArgBudget(customDefs, (kept) => renderAgentsJson(
@@ -49128,7 +49341,7 @@ function createSession(projectId, cwd, opts2 = {}) {
           customDefs = fit.kept;
           defs = [...withPhaseDelegation(requested, customDefs, agentForDefs), ...customDefs];
           if (defs.length === 0) return [];
-          writeFileSync13(file, fit.json, { mode: 384 });
+          writeFileSync14(file, fit.json, { mode: 384 });
         } catch (error) {
           if (phaseDefs.length === 0) throw error;
           return [error instanceof Error ? error.message : String(error)];
@@ -49208,8 +49421,8 @@ function createSession(projectId, cwd, opts2 = {}) {
   const sessionPrompt = bornPrompt(orchestrated);
   if (!opts2.command && sessionPrompt) {
     promptFile = promptFilePath(id2);
-    mkdirSync11(dirname10(promptFile), { recursive: true, mode: 448 });
-    writeFileSync13(promptFile, sessionPrompt + rosterBlock, { mode: 384 });
+    mkdirSync12(dirname11(promptFile), { recursive: true, mode: 448 });
+    writeFileSync14(promptFile, sessionPrompt + rosterBlock, { mode: 384 });
     promptArg = `"$(cat ${sq(promptFile)})"`;
   }
   const agent = opts2.agent ?? "claude";
@@ -49220,8 +49433,8 @@ function createSession(projectId, cwd, opts2 = {}) {
     let goalGate;
     if (agent === "codex" && opts2.goal && opts2.flow && opts2.specId) {
       goalGate = goalGatePath(id2);
-      mkdirSync11(dirname10(goalGate), { recursive: true, mode: 448 });
-      writeFileSync13(goalGate, codexGoalScript({
+      mkdirSync12(dirname11(goalGate), { recursive: true, mode: 448 });
+      writeFileSync14(goalGate, codexGoalScript({
         flow: opts2.flow,
         specId: opts2.specId,
         condition: opts2.goal,
@@ -49268,7 +49481,7 @@ function createSession(projectId, cwd, opts2 = {}) {
     for (const [k, v] of Object.entries(sessionEventEnv(id2))) envPairs.push(`${k}=${sq(v)}`);
   }
   if (opts2.phaseFile) {
-    mkdirSync11(dirname10(opts2.phaseFile), { recursive: true });
+    mkdirSync12(dirname11(opts2.phaseFile), { recursive: true });
     envPairs.push(`HANOMAN_PHASE_FILE=${sq(opts2.phaseFile)}`);
   }
   if (!opts2.command) {
@@ -49297,7 +49510,7 @@ function createSession(projectId, cwd, opts2 = {}) {
     });
     cmd = wrapped;
   }
-  if (opts2.decisionFile) mkdirSync11(dirname10(opts2.decisionFile), { recursive: true });
+  if (opts2.decisionFile) mkdirSync12(dirname11(opts2.decisionFile), { recursive: true });
   const bootstrap = runtime === "antigravity" ? createAntigravityEnvBootstrap(cmd, agentEnvironment(runtime, { ...process.env, ...opts2.env })) : void 0;
   if (bootstrap) cmd = bootstrap.command;
   try {
@@ -49704,11 +49917,11 @@ function killSession(id2) {
   cleanupAntigravityAgents({ cwd: p3.cwd, sessionId: id2 });
   cleanupInjectedSkills(agentTempDir(id2));
   try {
-    rmSync6(agentTempDir(id2), { recursive: true, force: true });
+    rmSync7(agentTempDir(id2), { recursive: true, force: true });
   } catch {
   }
   try {
-    rmSync6(sessionEventDir(id2), { recursive: true, force: true });
+    rmSync7(sessionEventDir(id2), { recursive: true, force: true });
   } catch {
   }
   emitDeath({ sessionId: id2, exitCode: p3.exited ? p3.code : null, transcript });
@@ -49767,7 +49980,7 @@ var init_pty = __esm({
     POLL_MS = 500;
     markerFilled = (f) => {
       try {
-        return statSync3(f).size > 0;
+        return statSync4(f).size > 0;
       } catch {
         return false;
       }
@@ -49781,7 +49994,7 @@ var init_pty = __esm({
     };
     clearMarker = (f) => {
       try {
-        writeFileSync13(f, "");
+        writeFileSync14(f, "");
       } catch {
       }
     };
@@ -49791,7 +50004,7 @@ var init_pty = __esm({
     markerOnset = (f) => {
       let raw;
       try {
-        raw = readFileSync13(f, "utf8");
+        raw = readFileSync14(f, "utf8");
       } catch {
         return 0;
       }
@@ -50045,7 +50258,7 @@ var init_redact_known = __esm({
 // src/services/transcript-store.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
 import { mkdir as mkdir2, writeFile as writeFile2, readFile as readFile3, unlink as unlink2, readdir as readdir2, stat as stat3 } from "node:fs/promises";
-import { join as join20, resolve as resolve10, basename as basename6 } from "node:path";
+import { join as join22, resolve as resolve10, basename as basename6 } from "node:path";
 function transcriptDir() {
   return resolve10(effectiveStr("HANOMAN_TRANSCRIPT_DIR")?.trim() || resolveDataDirs().transcripts);
 }
@@ -50065,13 +50278,13 @@ async function saveTranscript(text2) {
   const dir2 = transcriptDir();
   await mkdir2(dir2, { recursive: true, mode: 448 });
   const key = `${randomUUID5()}.log`;
-  await writeFile2(join20(dir2, key), body, { encoding: "utf8", mode: 384 });
+  await writeFile2(join22(dir2, key), body, { encoding: "utf8", mode: 384 });
   return { key, bytes: Buffer.byteLength(body, "utf8"), truncated };
 }
 async function readTranscript(key) {
   if (!key) return null;
   try {
-    return await readFile3(join20(transcriptDir(), basename6(key)), "utf8");
+    return await readFile3(join22(transcriptDir(), basename6(key)), "utf8");
   } catch {
     return null;
   }
@@ -50079,7 +50292,7 @@ async function readTranscript(key) {
 async function deleteTranscript(key) {
   if (!key) return;
   try {
-    await unlink2(join20(transcriptDir(), basename6(key)));
+    await unlink2(join22(transcriptDir(), basename6(key)));
   } catch (e) {
     if (e.code !== "ENOENT") throw e;
   }
@@ -50097,7 +50310,7 @@ async function listTranscripts() {
   for (const name2 of names) {
     if (!name2.endsWith(".log")) continue;
     try {
-      rows.push({ key: name2, mtimeMs: (await stat3(join20(dir2, name2))).mtimeMs });
+      rows.push({ key: name2, mtimeMs: (await stat3(join22(dir2, name2))).mtimeMs });
     } catch {
     }
   }
@@ -55390,13 +55603,13 @@ var init_tombstone = __esm({
 });
 
 // src/services/qa-attachment-sync.ts
-import { createHash as createHash8, randomUUID as randomUUID7 } from "node:crypto";
+import { createHash as createHash9, randomUUID as randomUUID7 } from "node:crypto";
 import { chmod, mkdir as mkdir4, rename as rename2, stat as stat4, writeFile as writeFile4 } from "node:fs/promises";
-import { join as join22 } from "node:path";
+import { join as join24 } from "node:path";
 async function qaBytesPresent(storageKey) {
   if (!QA_STORAGE_KEY.test(storageKey)) return false;
   try {
-    return (await stat4(join22(uploadDir(), storageKey))).isFile();
+    return (await stat4(join24(uploadDir(), storageKey))).isFile();
   } catch {
     return false;
   }
@@ -55411,7 +55624,7 @@ async function settleNewQaAttachment(id2) {
 }
 async function verifyQaBytes(meta, buf) {
   if (buf.length !== meta.size || buf.length === 0 || buf.length > QA_SYNC_MAX_BYTES) return { ok: false, status: 400, error: "size" };
-  if (createHash8("sha256").update(buf).digest("hex") !== meta.sha256) return { ok: false, status: 400, error: "sha256" };
+  if (createHash9("sha256").update(buf).digest("hex") !== meta.sha256) return { ok: false, status: 400, error: "sha256" };
   if (SNIFFABLE2.has(meta.mimeType)) {
     if ((await fileTypeFromBuffer(buf))?.mime !== meta.mimeType) return { ok: false, status: 415, error: "type" };
   } else if (!isUtf8Text2(buf)) return { ok: false, status: 415, error: "type" };
@@ -55421,10 +55634,10 @@ async function storeQaBytes(storageKey, buf) {
   if (!QA_STORAGE_KEY.test(storageKey)) throw new Error("storageKey tak sah");
   const dir2 = uploadDir();
   await mkdir4(dir2, { recursive: true, mode: 448 });
-  const tmp = join22(dir2, `${storageKey}.tmp-${randomUUID7()}`);
+  const tmp = join24(dir2, `${storageKey}.tmp-${randomUUID7()}`);
   await writeFile4(tmp, buf, { mode: 384 });
-  await rename2(tmp, join22(dir2, storageKey));
-  await chmod(join22(dir2, storageKey), 384).catch(() => {
+  await rename2(tmp, join24(dir2, storageKey));
+  await chmod(join24(dir2, storageKey), 384).catch(() => {
   });
 }
 var QA_STORAGE_KEY, QA_SYNC_MAX_BYTES, SNIFFABLE2, isUtf8Text2;
@@ -55668,9 +55881,9 @@ async function pull(sinceCursor, limit = 500, maxBytes = PULL_MAX_BYTES, opts2 =
 async function bootstrapSnapshot(after, maxBytes = PULL_MAX_BYTES, opts2 = {}) {
   const tip = await prisma.syncLog.findFirst({ orderBy: { seq: "desc" }, select: { seq: true } });
   const cursor = tip ? String(tip.seq) : "0";
-  const sep9 = after ? after.indexOf(":") : -1;
-  const afterEntity = sep9 > 0 ? after.slice(0, sep9) : null;
-  const afterId = sep9 > 0 ? after.slice(sep9 + 1) : null;
+  const sep11 = after ? after.indexOf(":") : -1;
+  const afterEntity = sep11 > 0 ? after.slice(0, sep11) : null;
+  const afterId = sep11 > 0 ? after.slice(sep11 + 1) : null;
   const startAt = afterEntity ? BOOTSTRAP_ORDER.indexOf(afterEntity) : 0;
   if (startAt < 0) throw new Error("bootstrap cursor tak dikenal");
   const records = [];
@@ -56075,9 +56288,9 @@ var init_sync_notify = __esm({
 // src/services/safe-repo-path.ts
 import { constants as constants3 } from "node:fs";
 import { lstat, mkdir as mkdir5, open as open2, realpath, rename as rename3, unlink as unlink4 } from "node:fs/promises";
-import { isAbsolute as isAbsolute10, join as join23, relative as relative5, resolve as resolve13, sep as sep6 } from "node:path";
+import { isAbsolute as isAbsolute10, join as join25, relative as relative6, resolve as resolve13, sep as sep7 } from "node:path";
 import { randomUUID as randomUUID8 } from "node:crypto";
-import { closeSync as closeSync3, fstatSync as fstatSync2, lstatSync as lstatSync9, mkdirSync as mkdirSync12, openSync as openSync3, readFileSync as readFileSync14, realpathSync as realpathSync7, renameSync as renameSync5, unlinkSync as unlinkSync4, writeFileSync as writeFileSync14 } from "node:fs";
+import { closeSync as closeSync3, fstatSync as fstatSync2, lstatSync as lstatSync9, mkdirSync as mkdirSync13, openSync as openSync3, readFileSync as readFileSync15, realpathSync as realpathSync7, renameSync as renameSync6, unlinkSync as unlinkSync4, writeFileSync as writeFileSync15 } from "node:fs";
 function components(rel) {
   if (!rel || isAbsolute10(rel) || rel.includes("\0")) denied("path invalid");
   const parts = rel.replace(/\\/g, "/").split("/");
@@ -56091,15 +56304,15 @@ async function canonicalRoot(root) {
   return out4;
 }
 function beneath(root, candidate) {
-  const rel = relative5(root, candidate);
-  return rel === "" || !rel.startsWith(`..${sep6}`) && rel !== ".." && !isAbsolute10(rel);
+  const rel = relative6(root, candidate);
+  return rel === "" || !rel.startsWith(`..${sep7}`) && rel !== ".." && !isAbsolute10(rel);
 }
 async function ensureRepoParents(root, rel) {
   const base3 = await canonicalRoot(root);
   const parts = components(rel).slice(0, -1);
   let current = base3;
   for (const part of parts) {
-    current = join23(current, part);
+    current = join25(current, part);
     try {
       await mkdir5(current, { mode: 448 });
     } catch (error) {
@@ -56116,9 +56329,9 @@ function ensureRepoParentsSync(root, rel) {
   const parts = components(rel).slice(0, -1);
   let current = base3;
   for (const part of parts) {
-    current = join23(current, part);
+    current = join25(current, part);
     try {
-      mkdirSync12(current, { mode: 448 });
+      mkdirSync13(current, { mode: 448 });
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
     }
@@ -56132,7 +56345,7 @@ async function resolveRepoEntry(root, rel, opts2 = {}) {
   const parts = components(rel);
   let current = base3;
   for (let i = 0; i < parts.length; i++) {
-    current = join23(current, parts[i]);
+    current = join25(current, parts[i]);
     const stat8 = await lstat(current).catch((error) => {
       if (error.code === "ENOENT" && opts2.allowMissingTail) return null;
       if (error.code === "ENOENT" && opts2.allowMissingFinal && i === parts.length - 1) return null;
@@ -56153,7 +56366,7 @@ function assertSafeRepoPathSync(root, rel, allowMissingFinal = false, allowMissi
   const parts = components(rel);
   let current = base3;
   for (let i = 0; i < parts.length; i++) {
-    current = join23(current, parts[i]);
+    current = join25(current, parts[i]);
     try {
       const stat8 = lstatSync9(current);
       if (stat8.isSymbolicLink()) denied("symlink");
@@ -56172,7 +56385,7 @@ function readRepoFileSync(root, rel) {
   const fd = openSync3(path, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0));
   try {
     if (!fstatSync2(fd).isFile()) denied("bukan file regular");
-    return readFileSync14(fd);
+    return readFileSync15(fd);
   } finally {
     closeSync3(fd);
   }
@@ -56181,12 +56394,12 @@ function writeRepoFileAtomicSync(root, rel, data) {
   ensureRepoParentsSync(root, rel);
   const path = assertSafeRepoPathSync(root, rel, true);
   const parent = resolve13(path, "..");
-  const parentRel = relative5(realpathSync7(root), parent);
+  const parentRel = relative6(realpathSync7(root), parent);
   if (parentRel) assertSafeRepoPathSync(root, parentRel);
-  const temp = join23(parent, `.hanoman-${randomUUID8()}.tmp`);
+  const temp = join25(parent, `.hanoman-${randomUUID8()}.tmp`);
   const fd = openSync3(temp, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | (constants3.O_NOFOLLOW ?? 0), 384);
   try {
-    writeFileSync14(fd, data);
+    writeFileSync15(fd, data);
   } finally {
     closeSync3(fd);
   }
@@ -56199,7 +56412,7 @@ function writeRepoFileAtomicSync(root, rel, data) {
       }
     })();
     if (final?.isSymbolicLink() || final && !final.isFile()) denied("target berubah");
-    renameSync5(temp, path);
+    renameSync6(temp, path);
   } catch (error) {
     try {
       unlinkSync4(temp);
@@ -56230,7 +56443,7 @@ async function writeRepoFileAtomic(root, rel, data) {
   await mkdir5(entry2.parent, { recursive: false, mode: 448 }).catch((error) => {
     if (error.code !== "EEXIST") throw error;
   });
-  const temp = join23(entry2.parent, `.hanoman-${randomUUID8()}.tmp`);
+  const temp = join25(entry2.parent, `.hanoman-${randomUUID8()}.tmp`);
   const handle = await open2(temp, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | (constants3.O_NOFOLLOW ?? 0), 384);
   try {
     await handle.writeFile(data);
@@ -56266,8 +56479,8 @@ var init_safe_repo_path = __esm({
 // src/services/integrate.ts
 import { execFile as execFile5 } from "node:child_process";
 import { promisify as promisify4 } from "node:util";
-import { rmSync as rmSync8 } from "node:fs";
-import { join as join24 } from "node:path";
+import { rmSync as rmSync9 } from "node:fs";
+import { join as join26 } from "node:path";
 async function worktreeForBranch(repoDir, branch) {
   let path = null;
   for (const line of (await out(repoDir, ["worktree", "list", "--porcelain"])).split("\n")) {
@@ -56292,7 +56505,7 @@ async function resolveTarget(repoDir, target3) {
 async function reclaim(repoDir, wt) {
   await sh(repoDir, ["worktree", "remove", "--force", wt]);
   await sh(repoDir, ["worktree", "prune"]);
-  rmSync8(wt, { recursive: true, force: true });
+  rmSync9(wt, { recursive: true, force: true });
 }
 async function integrateBranch(repoDir, src, op, target3) {
   const source = await resolveSource(repoDir, src.branch);
@@ -56300,7 +56513,7 @@ async function integrateBranch(repoDir, src, op, target3) {
   const tgt = await resolveTarget(repoDir, target3);
   if (!tgt) return { status: "error", code: 400, error: `target "${target3}" tidak dikenal` };
   await sh(repoDir, ["fetch", "origin"]);
-  const wt = join24(repoDir, ".worktrees", `merge-${sanitize(src.mergeId)}`);
+  const wt = join26(repoDir, ".worktrees", `merge-${sanitize(src.mergeId)}`);
   await reclaim(repoDir, wt);
   const baseRef = op === "merge" ? tgt.ref : source;
   const baseSha = await out(repoDir, ["rev-parse", "--verify", "--end-of-options", `${baseRef}^{commit}`]);
@@ -56361,7 +56574,7 @@ async function mergeIntoCurrent(repoDir, source, opts2 = {}) {
   const src = await resolveGraphSource(repoDir, source);
   if (!src) return { status: "error", code: 400, error: `source "${source}" tak dikenal` };
   await sh(repoDir, ["fetch", "origin"]);
-  const wt = join24(repoDir, ".worktrees", `merge-${sanitize(current)}`);
+  const wt = join26(repoDir, ".worktrees", `merge-${sanitize(current)}`);
   await reclaim(repoDir, wt);
   const baseSha = await out(repoDir, ["rev-parse", "--verify", "--end-of-options", `refs/heads/${current}^{commit}`]);
   if (!await ok(repoDir, ["worktree", "add", "--detach", "-q", wt, baseSha]))
@@ -56399,7 +56612,7 @@ async function replayCurrent(repoDir, source, cmd) {
   const current = await out(repoDir, ["rev-parse", "--abbrev-ref", "HEAD"]);
   if (!current || current === "HEAD")
     return { status: "error", code: 409, error: "HEAD detached \u2014 checkout sebuah branch dulu" };
-  const wt = join24(repoDir, ".worktrees", `merge-${sanitize(current)}`);
+  const wt = join26(repoDir, ".worktrees", `merge-${sanitize(current)}`);
   await reclaim(repoDir, wt);
   const baseSha = await out(repoDir, ["rev-parse", "--verify", "--end-of-options", `refs/heads/${current}^{commit}`]);
   if (!await ok(repoDir, ["worktree", "add", "--detach", "-q", wt, baseSha]))
@@ -56459,11 +56672,11 @@ import { execFile as execFile6 } from "node:child_process";
 import { promisify as promisify5 } from "node:util";
 import { mkdtemp, copyFile, rm as rm2 } from "node:fs/promises";
 import { tmpdir as tmpdir5 } from "node:os";
-import { join as join25, resolve as resolve15 } from "node:path";
+import { join as join27, resolve as resolve15 } from "node:path";
 async function withTempIndex(wt, fn) {
   const idx = (await exec4("git", ["rev-parse", "--git-path", "index"], { cwd: wt, ...GIT3 })).stdout.trim();
-  const dir2 = await mkdtemp(join25(tmpdir5(), "hanoman-idx-"));
-  const tmp = join25(dir2, "index");
+  const dir2 = await mkdtemp(join27(tmpdir5(), "hanoman-idx-"));
+  const tmp = join27(dir2, "index");
   await copyFile(resolve15(wt, idx), tmp);
   const env = { ...process.env, GIT_INDEX_FILE: tmp };
   try {
@@ -56609,7 +56822,7 @@ var init_spec_review2 = __esm({
     GIT3 = { maxBuffer: 1 << 24 };
     MAX = 256 * 1024;
     emptySpecReview = (reason) => ({ base: "", files: [], changed: [], empty: true, reason });
-    worktreeDir = (repoDir, specId) => join25(repoDir, ".worktrees", specId.toLowerCase().replace(/[^a-z0-9_-]/g, "_"));
+    worktreeDir = (repoDir, specId) => join27(repoDir, ".worktrees", specId.toLowerCase().replace(/[^a-z0-9_-]/g, "_"));
     splitZ = (s2) => s2.split("\0").filter(Boolean);
     EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
   }
@@ -56917,7 +57130,7 @@ var init_client = __esm({
 });
 
 // src/services/telegram/protocol.ts
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 function normalizeTelegramCommand(text2) {
   const clean3 = text2.trim();
   const match = clean3.match(/^\/([a-z0-9_]+)(?:@[a-z0-9_]+)?(?:\s+([\s\S]*))?$/i);
@@ -57006,7 +57219,7 @@ function parseTelegramUpdate(update2, allowlist, maxText = 12e3) {
   };
 }
 function inboundDigest(input) {
-  return createHash10("sha256").update(`${input.updateId}\0${input.chatId}\0${input.userId}\0${input.kind}\0${input.text}`, "utf8").digest("hex");
+  return createHash11("sha256").update(`${input.updateId}\0${input.chatId}\0${input.userId}\0${input.kind}\0${input.text}`, "utf8").digest("hex");
 }
 function sanitizeTelegramOutput(text2, exactSecrets = []) {
   let clean3 = text2.replace(ANSI, "").replace(CONTROLS, "");
@@ -57309,7 +57522,7 @@ var init_notifications2 = __esm({
 });
 
 // src/services/codex-trust.ts
-import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync13, readFileSync as readFileSync15, realpathSync as realpathSync9 } from "node:fs";
+import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync14, readFileSync as readFileSync16, realpathSync as realpathSync9 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
 function ensureCodexTrust(repoDir, home3) {
   const path = codexConfigPath(home3);
@@ -57322,11 +57535,11 @@ function ensureCodexTrust(repoDir, home3) {
   try {
     let existing = "";
     try {
-      existing = readFileSync15(path, "utf8");
+      existing = readFileSync16(path, "utf8");
     } catch {
     }
     if (existing.includes(header2)) return;
-    mkdirSync13(codexHome(home3), { recursive: true });
+    mkdirSync14(codexHome(home3), { recursive: true });
     const lead = existing === "" || existing.endsWith("\n") ? "" : "\n";
     appendFileSync3(path, `${lead}
 ${header2}
@@ -57466,8 +57679,8 @@ var init_device_sockets = __esm({
 
 // src/services/exit-guard.ts
 import { spawn as spawn3 } from "node:child_process";
-import { writeFileSync as writeFileSync15 } from "node:fs";
-import { join as join29 } from "node:path";
+import { writeFileSync as writeFileSync16 } from "node:fs";
+import { join as join31 } from "node:path";
 function watchdogScript(pid, graceMs) {
   const secs = Math.max(1, Math.ceil(graceMs / 1e3));
   return `s=$(ps -o lstart= -p ${pid}); sleep ${secs}; [ -n "$s" ] && [ "$(ps -o lstart= -p ${pid})" = "$s" ] && kill -9 ${pid}`;
@@ -57483,8 +57696,8 @@ function launchWatchdog(script2, env = process.env) {
 function exitGuarded(code, d = {}) {
   const pid = d.pid ?? process.pid;
   try {
-    const write2 = d.writeIntent ?? ((p3, t) => writeFileSync15(p3, t, { mode: 384 }));
-    write2(join29(d.home ?? resolveHome(), EXIT_INTENT_FILE), formatExitIntent(pid, code));
+    const write2 = d.writeIntent ?? ((p3, t) => writeFileSync16(p3, t, { mode: 384 }));
+    write2(join31(d.home ?? resolveHome(), EXIT_INTENT_FILE), formatExitIntent(pid, code));
   } catch {
   }
   try {
@@ -57504,9 +57717,9 @@ var init_exit_guard = __esm({
 });
 
 // src/services/update.ts
-import { readFileSync as readFileSync16 } from "node:fs";
-import { resolve as resolve20, dirname as dirname13 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { readFileSync as readFileSync17 } from "node:fs";
+import { resolve as resolve20, dirname as dirname14 } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 function composeUpdate(x) {
   const available = x.registryStatus === "ok" && x.latestVersion != null && compareSemver(x.latestVersion, x.currentVersion) > 0;
   return {
@@ -57522,10 +57735,10 @@ function composeUpdate(x) {
   };
 }
 function runningVersion() {
-  const here = dirname13(fileURLToPath3(import.meta.url));
+  const here = dirname14(fileURLToPath4(import.meta.url));
   for (const p3 of [resolve20(here, "build-info.json"), resolve20(here, "../package.json")]) {
     try {
-      const v = JSON.parse(readFileSync16(p3, "utf8")).version;
+      const v = JSON.parse(readFileSync17(p3, "utf8")).version;
       if (typeof v === "string" && v) return v;
     } catch {
     }
@@ -57961,7 +58174,7 @@ var init_remote_session = __esm({
 
 // src/services/spec-attachment-dir.ts
 import { mkdir as mkdir6, readdir as readdir5, readFile as readFile6, rm as rm4, writeFile as writeFile5 } from "node:fs/promises";
-import { join as join30 } from "node:path";
+import { join as join32 } from "node:path";
 function uniqueName(taken, filename) {
   if (!taken.has(filename)) {
     taken.add(filename);
@@ -58009,19 +58222,19 @@ async function syncSpecAttachmentsDir(specId, projectId) {
   for (const a of rows) {
     let bytes;
     try {
-      bytes = await readFile6(join30(uploadDir(), a.storageKey));
+      bytes = await readFile6(join32(uploadDir(), a.storageKey));
     } catch {
       continue;
     }
     const filename = uniqueName(taken, a.filename);
-    const path = join30(dir2, filename);
+    const path = join32(dir2, filename);
     await writeFile5(path, bytes, { mode: 384 });
     items.push({ filename, mimeType: a.mimeType, size: a.size, path });
   }
-  await writeFile5(join30(dir2, INDEX), renderIndex(specId, items), { mode: 384 });
+  await writeFile5(join32(dir2, INDEX), renderIndex(specId, items), { mode: 384 });
   const keep = /* @__PURE__ */ new Set([INDEX, ...items.map((a) => a.filename)]);
   for (const name2 of await readdir5(dir2)) {
-    if (!keep.has(name2)) await rm4(join30(dir2, name2), { recursive: true, force: true }).catch(() => {
+    if (!keep.has(name2)) await rm4(join32(dir2, name2), { recursive: true, force: true }).catch(() => {
     });
   }
   return items;
@@ -58040,7 +58253,7 @@ var init_spec_attachment_dir = __esm({
     init_local_binding();
     init_session_id();
     init_uploads();
-    specAttachmentsDir = (repoDir, sessionId2) => join30(repoDir, ".worktrees", ".attachments", sessionId2);
+    specAttachmentsDir = (repoDir, sessionId2) => join32(repoDir, ".worktrees", ".attachments", sessionId2);
     INDEX = "INDEX.md";
     humanSize = (n2) => n2 >= 1024 * 1024 ? `${(n2 / 1024 / 1024).toFixed(1)} MB` : n2 >= 1024 ? `${Math.round(n2 / 1024)} KB` : `${n2} B`;
   }
@@ -58435,7 +58648,7 @@ var init_runtime_defaults2 = __esm({
 });
 
 // src/services/agent-token.ts
-import { randomBytes as randomBytes2, createHash as createHash12, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+import { randomBytes as randomBytes2, createHash as createHash13, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 function toAgentTokenView(t) {
   return {
     id: t.id,
@@ -58522,7 +58735,7 @@ var init_agent_token = __esm({
   "src/services/agent-token.ts"() {
     "use strict";
     init_db();
-    hash2 = (token) => createHash12("sha256").update(token).digest("hex");
+    hash2 = (token) => createHash13("sha256").update(token).digest("hex");
     AGENT_CREATOR_PREFIX = "agent:";
   }
 });
@@ -58851,11 +59064,11 @@ var init_project_config = __esm({
 
 // src/services/limits.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
-import { readFileSync as readFileSync17 } from "node:fs";
+import { readFileSync as readFileSync18 } from "node:fs";
 import { homedir as homedir6, userInfo } from "node:os";
-import { join as join31 } from "node:path";
+import { join as join34 } from "node:path";
 function credsFile() {
-  return join31(effectiveStr("CLAUDE_CONFIG_DIR") ?? join31(homedir6(), ".claude"), ".credentials.json");
+  return join34(effectiveStr("CLAUDE_CONFIG_DIR") ?? join34(homedir6(), ".claude"), ".credentials.json");
 }
 function keychainAccessToken(run6 = securityRun, account = osAccount()) {
   const base3 = ["find-generic-password", "-s", "Claude Code-credentials"];
@@ -58874,7 +59087,7 @@ function readAccessToken() {
     if (tok) return tok;
   }
   try {
-    return JSON.parse(readFileSync17(credsFile(), "utf8"))?.claudeAiOauth?.accessToken ?? null;
+    return JSON.parse(readFileSync18(credsFile(), "utf8"))?.claudeAiOauth?.accessToken ?? null;
   } catch {
     return null;
   }
@@ -58958,7 +59171,7 @@ var init_limits = __esm({
 // src/services/codex-limits.ts
 import { open as open3, readdir as readdir6, stat as stat6 } from "node:fs/promises";
 import { homedir as homedir7 } from "node:os";
-import { join as join32 } from "node:path";
+import { join as join35 } from "node:path";
 function windowLabel(minutes) {
   if (minutes === 300) return "Sesi 5 jam";
   if (minutes === 10080) return "Mingguan";
@@ -58989,7 +59202,7 @@ async function recentRollouts(dir2) {
     return [];
   }
   const stamped = await Promise.all(entries4.map(async (rel) => {
-    const full = join32(dir2, rel);
+    const full = join35(dir2, rel);
     try {
       return { full, mtime: (await stat6(full)).mtimeMs };
     } catch {
@@ -59069,7 +59282,7 @@ var init_codex_limits = __esm({
     MAX_FILES = 8;
     cache2 = null;
     freshUntil2 = 0;
-    codexSessionsDir = () => join32(process.env.CODEX_HOME ?? join32(homedir7(), ".codex"), "sessions");
+    codexSessionsDir = () => join35(process.env.CODEX_HOME ?? join35(homedir7(), ".codex"), "sessions");
     UNAVAILABLE = { status: "unavailable", windows: [], fetchedAt: null, plan: null };
     severityOf = (pct3) => pct3 >= 90 ? "critical" : pct3 >= 70 ? "warning" : "normal";
   }
@@ -59077,9 +59290,9 @@ var init_codex_limits = __esm({
 
 // src/services/antigravity-limits.ts
 import { execFileSync as execFileSync7 } from "node:child_process";
-import { readFileSync as readFileSync18 } from "node:fs";
+import { readFileSync as readFileSync19 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
-import { join as join33 } from "node:path";
+import { join as join36 } from "node:path";
 function readAgyToken(run6 = securityRun2) {
   try {
     let raw = run6(["find-generic-password", "-s", "gemini", "-a", "antigravity", "-w"]).trim();
@@ -59095,7 +59308,7 @@ function readAgyToken(run6 = securityRun2) {
 }
 function defaultProject() {
   try {
-    return readFileSync18(join33(agyHome(), "cache", "default_project_id.txt"), "utf8").trim() || null;
+    return readFileSync19(join36(agyHome(), "cache", "default_project_id.txt"), "utf8").trim() || null;
   } catch {
     return null;
   }
@@ -59186,7 +59399,7 @@ var init_antigravity_limits = __esm({
     freshUntil3 = 0;
     UNAVAILABLE2 = { status: "unavailable", windows: [], fetchedAt: null };
     securityRun2 = (args) => execFileSync7("security", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
-    agyHome = () => join33(homedir8(), ".gemini", "antigravity-cli");
+    agyHome = () => join36(homedir8(), ".gemini", "antigravity-cli");
     severityOf2 = (pct3) => pct3 >= 90 ? "critical" : pct3 >= 70 ? "warning" : "normal";
     prodDeps = {
       platform: process.platform,
@@ -59285,7 +59498,7 @@ var init_budget = __esm({
 });
 
 // src/services/session-dialog.ts
-import { createHash as createHash13 } from "node:crypto";
+import { createHash as createHash14 } from "node:crypto";
 function readSessionDialog(io) {
   const text2 = io.capture();
   const s2 = answerable(text2);
@@ -59341,7 +59554,7 @@ var init_session_dialog2 = __esm({
     init_tui_dialog();
     init_pty();
     DIALOG_CHUNK_MS = 50;
-    screenHashOf = (paneText2) => createHash13("sha256").update(dialogKey(paneText2)).digest("hex").slice(0, 16);
+    screenHashOf = (paneText2) => createHash14("sha256").update(dialogKey(paneText2)).digest("hex").slice(0, 16);
     answerable = (paneText2) => {
       const s2 = readDialogScreen(paneText2);
       if (s2?.kind !== "question") return null;
@@ -59644,8 +59857,8 @@ var init_prompt2 = __esm({
 });
 
 // src/services/lead/verdict.ts
-import { existsSync as existsSync15 } from "node:fs";
-import { isAbsolute as isAbsolute11, resolve as resolvePath2, relative as relative6 } from "node:path";
+import { existsSync as existsSync18 } from "node:fs";
+import { isAbsolute as isAbsolute11, resolve as resolvePath2, relative as relative7 } from "node:path";
 function extractJsonBlock(raw) {
   const re = /```json\s*\n([\s\S]*?)```/g;
   let last2 = null;
@@ -59678,9 +59891,9 @@ function keepExistingRefs(refs2, repoDir) {
     if (!repoDir) continue;
     if (isAbsolute11(ref)) continue;
     const full = resolvePath2(repoDir, ref);
-    const rel = relative6(repoDir, full);
+    const rel = relative7(repoDir, full);
     if (rel.startsWith("..")) continue;
-    if (existsSync15(full)) out4.push(ref);
+    if (existsSync18(full)) out4.push(ref);
   }
   return [...new Set(out4)];
 }
@@ -60870,9 +61083,9 @@ var init_queue = __esm({
 });
 
 // src/services/git-auth.ts
-import { chmodSync as chmodSync8, mkdirSync as mkdirSync14, writeFileSync as writeFileSync16 } from "node:fs";
+import { chmodSync as chmodSync9, mkdirSync as mkdirSync15, writeFileSync as writeFileSync17 } from "node:fs";
 import { tmpdir as tmpdir6 } from "node:os";
-import { dirname as dirname14 } from "node:path";
+import { dirname as dirname15 } from "node:path";
 function httpsRemote(remote) {
   const scp = /^[\w.-]+@github\.com:(.+)$/.exec(remote);
   if (scp) return `https://github.com/${scp[1]}`;
@@ -60882,9 +61095,9 @@ function httpsRemote(remote) {
 }
 function gitAuthEnv(token) {
   const path = gitAskpassPath();
-  mkdirSync14(dirname14(path), { recursive: true, mode: 448 });
-  writeFileSync16(path, ASKPASS_TOKEN, { mode: 448 });
-  chmodSync8(path, 448);
+  mkdirSync15(dirname15(path), { recursive: true, mode: 448 });
+  writeFileSync17(path, ASKPASS_TOKEN, { mode: 448 });
+  chmodSync9(path, 448);
   return { GIT_ASKPASS: path, GIT_TERMINAL_PROMPT: "0", HANOMAN_GIT_TOKEN: token };
 }
 var gitAskpassPath, ASKPASS_TOKEN, isGithubHttps;
@@ -63884,7 +64097,7 @@ var require_websocket2 = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes12, createHash: createHash23 } = __require("crypto");
+    var { randomBytes: randomBytes12, createHash: createHash24 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate2();
@@ -64552,7 +64765,7 @@ var require_websocket2 = __commonJS({
           abortHandshake(websocket2, socket2, "Invalid Upgrade header");
           return;
         }
-        const digest3 = createHash23("sha1").update(key + GUID).digest("base64");
+        const digest3 = createHash24("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest3) {
           abortHandshake(websocket2, socket2, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -64921,7 +65134,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash23 } = __require("crypto");
+    var { createHash: createHash24 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate2();
     var subprotocol2 = require_subprotocol();
@@ -65228,7 +65441,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket2, 503);
-        const digest3 = createHash23("sha1").update(key + GUID).digest("base64");
+        const digest3 = createHash24("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -65524,16 +65737,16 @@ var init_client2 = __esm({
 });
 
 // src/services/logs/spool.ts
-import { appendFile, mkdir as mkdir7, readFile as readFile7, readdir as readdir7, rm as rm5, stat as stat7 } from "node:fs/promises";
-import { join as join34 } from "node:path";
+import { appendFile, mkdir as mkdir7, readFile as readFile8, readdir as readdir7, rm as rm5, stat as stat7 } from "node:fs/promises";
+import { join as join37 } from "node:path";
 function spoolDir(lane) {
-  return join34(resolveDataDirs().home, "log-spool", lane);
+  return join37(resolveDataDirs().home, "log-spool", lane);
 }
 async function currentSegment(lane) {
   const dir2 = spoolDir(lane);
   await mkdir7(dir2, { recursive: true, mode: 448 });
   if (currentFile && currentBytes < LOG_SPOOL_SEGMENT_BYTES) return currentFile;
-  currentFile = join34(dir2, `${Date.now()}-${++segCounter}.ndjson`);
+  currentFile = join37(dir2, `${Date.now()}-${++segCounter}.ndjson`);
   currentBytes = 0;
   return currentFile;
 }
@@ -65555,8 +65768,8 @@ async function readSpoolSegments(lane) {
   const files2 = names.filter((n2) => n2.endsWith(".ndjson")).sort();
   const out4 = [];
   for (const name2 of files2) {
-    const file = join34(dir2, name2);
-    const raw = await readFile7(file, "utf8").catch(() => "");
+    const file = join37(dir2, name2);
+    const raw = await readFile8(file, "utf8").catch(() => "");
     const entries4 = raw.split("\n").filter(Boolean).map((l) => JSON.parse(l));
     out4.push({ file, entries: entries4 });
   }
@@ -66220,8 +66433,8 @@ var init_git_token = __esm({
 
 // src/services/project-checkout.ts
 import { execFile as execFile14, spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync16, readdirSync as readdirSync8, rmSync as rmSync9 } from "node:fs";
-import { join as join35 } from "node:path";
+import { existsSync as existsSync19, readdirSync as readdirSync10, rmSync as rmSync10 } from "node:fs";
+import { join as join38 } from "node:path";
 import { promisify as promisify13 } from "node:util";
 async function runGit(args, o) {
   const full = o.token ? ["-c", "credential.helper=", ...args] : args;
@@ -66243,8 +66456,8 @@ async function doClone(projectId, opts2) {
   if (!project) throw new CheckoutError(`project "${projectId}" tidak ada`, "not-found");
   if (!project.gitRemote) throw new CheckoutError(`project "${projectId}" tidak punya gitRemote untuk di-clone`, "no-remote");
   const remote = project.gitRemote;
-  const dest = opts2.dir ?? join35(checkoutRoot(), slug(project.id));
-  if (existsSync16(dest) && !isEmptyDir(dest)) {
+  const dest = opts2.dir ?? join38(checkoutRoot(), slug(project.id));
+  if (existsSync19(dest) && !isEmptyDir(dest)) {
     const origin = originOf2(dest);
     if (origin && sameRemote(origin, remote)) {
       await setBinding(projectId, dest);
@@ -66260,7 +66473,7 @@ async function doClone(projectId, opts2) {
     timeout: CLONE_TIMEOUT_MS
   });
   if (!res.ok) {
-    rmSync9(dest, { recursive: true, force: true });
+    rmSync10(dest, { recursive: true, force: true });
     const auth = AUTH_RE.test(res.stderr);
     throw new CheckoutError(
       auth ? useAuth ? `token GitHub ditolak atau tanpa akses ke ${remote}` : `akses ke ${remote} ditolak: isi GITHUB_TOKEN di Settings atau hubungkan instance ini ke hub` : `git clone ${remote} gagal`,
@@ -66307,7 +66520,7 @@ var init_project_checkout = __esm({
     CLONE_TIMEOUT_MS = 10 * 6e4;
     FETCH_TIMEOUT_MS = 2 * 6e4;
     AUTH_RE = /Authentication failed|could not read (Username|Password)|Invalid username or password|HTTP 40[13]|returned error: 40[13]|Repository not found|Permission denied \(publickey\)/i;
-    checkoutRoot = () => join35(resolveHome(), "projects");
+    checkoutRoot = () => join38(resolveHome(), "projects");
     slug = (id2) => id2.toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "") || "project";
     sameRemote = (a, b) => {
       const norm5 = (u) => httpsRemote(u).replace(/\.git$/, "").replace(/\/+$/, "").toLowerCase();
@@ -66316,7 +66529,7 @@ var init_project_checkout = __esm({
     redact = (text2, token) => token ? text2.split(token).join("***") : text2;
     isEmptyDir = (dir2) => {
       try {
-        return readdirSync8(dir2).length === 0;
+        return readdirSync10(dir2).length === 0;
       } catch {
         return false;
       }
@@ -67085,7 +67298,7 @@ var init_approvals = __esm({
 });
 
 // src/services/telegram/gateway.ts
-import { createHash as createHash14 } from "node:crypto";
+import { createHash as createHash15 } from "node:crypto";
 var digestRaw, TelegramGateway;
 var init_gateway = __esm({
   "src/services/telegram/gateway.ts"() {
@@ -67094,7 +67307,7 @@ var init_gateway = __esm({
     init_protocol();
     init_runtime();
     init_typing();
-    digestRaw = (update2) => createHash14("sha256").update(JSON.stringify(update2)).digest("hex");
+    digestRaw = (update2) => createHash15("sha256").update(JSON.stringify(update2)).digest("hex");
     TelegramGateway = class {
       constructor(deps) {
         this.deps = deps;
@@ -67418,14 +67631,14 @@ var init_engine_command = __esm({
 });
 
 // src/services/telegram/session.ts
-import { createHash as createHash15 } from "node:crypto";
+import { createHash as createHash16 } from "node:crypto";
 var chatHash, telegramOperatorSessionId, formatTelegramTurn, TelegramSessionCoordinator;
 var init_session = __esm({
   "src/services/telegram/session.ts"() {
     "use strict";
     init_src2();
     init_engine_command();
-    chatHash = (chatId) => createHash15("sha256").update(chatId).digest("hex").slice(0, 16);
+    chatHash = (chatId) => createHash16("sha256").update(chatId).digest("hex").slice(0, 16);
     telegramOperatorSessionId = (chatId) => `telegram-${chatHash(chatId)}`;
     formatTelegramTurn = (input) => `[Telegram update ${input.updateId} \xB7 chat ${input.chatId} \xB7 kind ${input.kind}]
 ${input.text}`;
@@ -67822,7 +68035,7 @@ __export(bootstrap_exports, {
   reloadTelegramGateway: () => reloadTelegramGateway,
   telegramSessionDeps: () => telegramSessionDeps
 });
-import { mkdirSync as mkdirSync15 } from "node:fs";
+import { mkdirSync as mkdirSync16 } from "node:fs";
 function parseTelegramAllowedUserIds(raw) {
   const ids = raw.split(/[\s,]+/).filter(Boolean);
   if (!ids.length) throw new Error("Telegram allowlist wajib berisi numeric user id");
@@ -67847,7 +68060,7 @@ function telegramSessionDeps(input) {
     home: resolveHome(),
     apiBase: input.apiBase,
     agentToken: input.agentToken,
-    ensureDir: (path) => mkdirSync15(path, { recursive: true })
+    ensureDir: (path) => mkdirSync16(path, { recursive: true })
   };
 }
 async function productionFactory(input) {
@@ -68069,17 +68282,17 @@ var init_codex_version = __esm({
 });
 
 // src/services/agent-tool-catalog.ts
-import { readFileSync as readFileSync26 } from "node:fs";
+import { readFileSync as readFileSync27 } from "node:fs";
 import { homedir as homedir13 } from "node:os";
-import { join as join49 } from "node:path";
+import { join as join51 } from "node:path";
 function mcpServerNames(repoDir) {
   const names = [];
-  const claudeJson = readJson2(join49(home(), ".claude.json"));
+  const claudeJson = readJson2(join51(home(), ".claude.json"));
   names.push(...serversOf(claudeJson));
   if (repoDir) {
     const projects = claudeJson?.projects;
     if (projects && typeof projects === "object") names.push(...serversOf(projects[repoDir]));
-    names.push(...serversOf(readJson2(join49(repoDir, ".mcp.json"))));
+    names.push(...serversOf(readJson2(join51(repoDir, ".mcp.json"))));
   }
   names.push(...codexServers());
   return [...new Set(names.filter(Boolean))].sort((a, b) => a.localeCompare(b));
@@ -68095,7 +68308,7 @@ var init_agent_tool_catalog = __esm({
     home = () => process.env.HOME || homedir13();
     readJson2 = (path) => {
       try {
-        return JSON.parse(readFileSync26(path, "utf8"));
+        return JSON.parse(readFileSync27(path, "utf8"));
       } catch {
         return null;
       }
@@ -68108,7 +68321,7 @@ var init_agent_tool_catalog = __esm({
     codexServers = () => {
       let text2;
       try {
-        text2 = readFileSync26(join49(home(), ".codex", "config.toml"), "utf8");
+        text2 = readFileSync27(join51(home(), ".codex", "config.toml"), "utf8");
       } catch {
         return [];
       }
@@ -68124,7 +68337,7 @@ var init_agent_tool_catalog = __esm({
 });
 
 // src/services/builtin-agents.ts
-import { createHash as createHash19 } from "node:crypto";
+import { createHash as createHash20 } from "node:crypto";
 async function seedBuiltinAgents() {
   try {
     const setting = await getSetting();
@@ -68226,7 +68439,7 @@ var init_builtin_agents2 = __esm({
     init_settings3();
     init_tombstone();
     init_sync_notify();
-    digest2 = (parts) => createHash19("sha256").update(parts.join(" ")).digest("hex").slice(0, 16);
+    digest2 = (parts) => createHash20("sha256").update(parts.join(" ")).digest("hex").slice(0, 16);
     legacyFingerprint = (name2, description, instructions, tools) => digest2([name2, description, instructions, [...tools].join(",")]);
     mentionPart = (v) => {
       const m = mentionsOf(v);
@@ -71726,9 +71939,9 @@ import Fastify from "fastify";
 import fastifyStatic from "@fastify/static";
 import websocket from "@fastify/websocket";
 import cookie from "@fastify/cookie";
-import { fileURLToPath as fileURLToPath5 } from "node:url";
+import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { dirname as dirname19 } from "node:path";
-import { existsSync as existsSync23 } from "node:fs";
+import { existsSync as existsSync25 } from "node:fs";
 
 // src/web-dir.ts
 import { resolve as resolve11 } from "node:path";
@@ -71782,7 +71995,7 @@ async function agent_doc_default(app3, opts2) {
 init_config2();
 init_db();
 init_uploads();
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 
 // src/services/upload-pipeline.ts
 init_file_type();
@@ -71792,7 +72005,7 @@ init_uploads();
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { spawn as spawn2 } from "node:child_process";
 import { mkdir as mkdir3, rename, unlink as unlink3, writeFile as writeFile3 } from "node:fs/promises";
-import { basename as basename7, isAbsolute as isAbsolute9, join as join21 } from "node:path";
+import { basename as basename7, isAbsolute as isAbsolute9, join as join23 } from "node:path";
 import sharp from "sharp";
 var UPLOAD_LIMITS = {
   fileBytes: 5 * 1024 * 1024,
@@ -71866,16 +72079,16 @@ function safeFilename2(input, extension2) {
 }
 async function commitToStorage(buffer, extension2, deps, beforePromote) {
   const storageDir = deps.storageDir ?? uploadDir();
-  const quarantineDir = join21(storageDir, ".quarantine");
+  const quarantineDir = join23(storageDir, ".quarantine");
   await mkdir3(quarantineDir, { recursive: true, mode: 448 });
   await mkdir3(storageDir, { recursive: true, mode: 448 });
-  const quarantine = join21(quarantineDir, `${randomUUID6()}.upload`);
+  const quarantine = join23(quarantineDir, `${randomUUID6()}.upload`);
   const storageKey = `${randomUUID6()}${extension2}`;
   await writeFile3(quarantine, buffer, { mode: 384, flag: "wx" });
   try {
     await timeout((deps.scanner ?? scannerFromEnv)(quarantine), UPLOAD_LIMITS.scanMs, "UPLOAD_SCAN");
     await beforePromote?.();
-    await rename(quarantine, join21(storageDir, storageKey));
+    await rename(quarantine, join23(storageDir, storageKey));
   } catch (error) {
     await unlink3(quarantine).catch(() => {
     });
@@ -72277,7 +72490,7 @@ async function addQaAttachments(report, owner, files2) {
       continue;
     }
     try {
-      const sha256 = createHash9("sha256").update(await readUpload(safe3.storageKey)).digest("hex");
+      const sha256 = createHash10("sha256").update(await readUpload(safe3.storageKey)).digest("hex");
       const row = await prisma.qaAttachment.create({ data: {
         reportId: report.id,
         projectId: report.projectId,
@@ -72331,7 +72544,7 @@ init_src();
 init_safe_repo_path();
 import { execFile as execFile3 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
-import { existsSync as existsSync11, rmSync as rmSync7 } from "node:fs";
+import { existsSync as existsSync13, rmSync as rmSync8 } from "node:fs";
 import { resolve as resolve14 } from "node:path";
 var exec = promisify2(execFile3);
 async function listRepoDocs(repoDir) {
@@ -72356,12 +72569,12 @@ function docsDirOf(repoDir) {
 }
 function resolveIndex(repoDir, docsDir) {
   const rel = `${docsDir}/README.md`;
-  return existsSync11(resolve14(repoDir, rel)) ? rel : "";
+  return existsSync13(resolve14(repoDir, rel)) ? rel : "";
 }
 var catOf = (rel) => rel.includes("/") ? rel.slice(0, rel.lastIndexOf("/")) : ".";
 var nameOf = (rel) => rel.includes("/") ? rel.slice(rel.lastIndexOf("/") + 1) : rel;
 async function scanRepoDocs(repoDir) {
-  if (!repoDir || !existsSync11(repoDir)) return { coverage: 0, tree: [] };
+  if (!repoDir || !existsSync13(repoDir)) return { coverage: 0, tree: [] };
   const files2 = await listRepoDocs(repoDir);
   const docsDir = docsDirOf(repoDir);
   const index = resolveIndex(repoDir, docsDir);
@@ -72409,8 +72622,8 @@ function writeDocFile(repoDir, rel, content) {
 }
 function deleteDocFile(repoDir, rel) {
   const abs = docAbsPath(repoDir, rel);
-  if (!existsSync11(abs)) return false;
-  rmSync7(abs);
+  if (!existsSync13(abs)) return false;
+  rmSync8(abs);
   return true;
 }
 
@@ -72728,7 +72941,7 @@ async function projects_default(app3) {
 init_src();
 init_src2();
 init_integrate();
-import { existsSync as existsSync14 } from "node:fs";
+import { existsSync as existsSync17 } from "node:fs";
 import { basename as basename9 } from "node:path";
 
 // src/services/worktree-delete.ts
@@ -72747,7 +72960,7 @@ init_spec_review2();
 init_safe_repo_path();
 import { execFile as execFile7 } from "node:child_process";
 import { promisify as promisify6 } from "node:util";
-import { existsSync as existsSync12 } from "node:fs";
+import { existsSync as existsSync14 } from "node:fs";
 import { readdir as readdir3 } from "node:fs/promises";
 import { resolve as resolve16 } from "node:path";
 var exec5 = promisify6(execFile7);
@@ -72760,7 +72973,7 @@ function repoAbsPath(repoDir, rel, allowMissingFinal = false) {
   return resolve16(repoDir, rel);
 }
 async function listRepoTree(repoDir, ref = "") {
-  if (!repoDir || !existsSync12(repoDir)) return [];
+  if (!repoDir || !existsSync14(repoDir)) return [];
   try {
     const { stdout } = ref ? await exec5("git", ["ls-tree", "-r", "--name-only", "-z", ref], { cwd: repoDir, ...GIT4 }) : await exec5("git", ["ls-files", "--cached", "--others", "--exclude-standard", "-z"], { cwd: repoDir, ...GIT4 });
     return [...new Set(splitZ2(stdout))].sort();
@@ -72770,7 +72983,7 @@ async function listRepoTree(repoDir, ref = "") {
 }
 async function listIgnoredEntries(repoDir) {
   const empty = { files: [], dirs: [] };
-  if (!repoDir || !existsSync12(repoDir)) return empty;
+  if (!repoDir || !existsSync14(repoDir)) return empty;
   try {
     const { stdout } = await exec5(
       "git",
@@ -72823,7 +73036,7 @@ async function currentBranch(repoDir) {
 }
 async function repoStatus(repoDir) {
   const empty = { branch: "", ahead: 0, behind: 0, staged: [], unstaged: [], untracked: [], clean: true };
-  if (!repoDir || !existsSync12(repoDir)) return empty;
+  if (!repoDir || !existsSync14(repoDir)) return empty;
   try {
     const { stdout } = await exec5("git", ["status", "--porcelain=v1", "-z", "-b"], { cwd: repoDir, ...GIT4 });
     const parts = stdout.split("\0");
@@ -72856,7 +73069,7 @@ async function repoStatus(repoDir) {
   }
 }
 async function listStashes(repoDir) {
-  if (!repoDir || !existsSync12(repoDir)) return [];
+  if (!repoDir || !existsSync14(repoDir)) return [];
   try {
     const { stdout } = await exec5("git", ["stash", "list", `--format=%gd${US}%s${US}%aI`], { cwd: repoDir, ...GIT4 });
     return stdout.split("\n").filter(Boolean).map((line) => {
@@ -72868,7 +73081,7 @@ async function listStashes(repoDir) {
   }
 }
 async function listGraph(repoDir, limit = 200, opts2 = {}) {
-  if (!repoDir || !existsSync12(repoDir)) return { commits: [], current: "", total: 0 };
+  if (!repoDir || !existsSync14(repoDir)) return { commits: [], current: "", total: 0 };
   try {
     const fmt = ["%H", "%P", "%an", "%aI", "%s", "%D"].join(US);
     const refArgs = opts2.branches?.length ? ["--end-of-options", ...opts2.branches] : [
@@ -72938,7 +73151,7 @@ async function changedOf(repoDir, sha2) {
 }
 async function compareCommits(repoDir, from, to) {
   const empty = { from, to, changed: [] };
-  if (!repoDir || !existsSync12(repoDir)) return empty;
+  if (!repoDir || !existsSync14(repoDir)) return empty;
   try {
     const [num, name2] = await Promise.all([
       exec5("git", ["diff", "--numstat", "-z", "--no-renames", "--end-of-options", from, to], { cwd: repoDir, ...GIT4 }),
@@ -72950,7 +73163,7 @@ async function compareCommits(repoDir, from, to) {
   }
 }
 async function searchCommits(repoDir, q2, by = "all") {
-  if (!repoDir || !existsSync12(repoDir) || !q2) return [];
+  if (!repoDir || !existsSync14(repoDir) || !q2) return [];
   const run6 = async (extra) => {
     try {
       return (await exec5("git", ["log", "--all", "--format=%H", ...extra], { cwd: repoDir, ...GIT4 })).stdout.split("\n").filter(Boolean);
@@ -73197,7 +73410,7 @@ async function runGitOp(repoDir, op) {
   }
 }
 async function workingStatus(repoDir) {
-  if (!repoDir || !existsSync12(repoDir)) return { branch: "", staged: [], unstaged: [] };
+  if (!repoDir || !existsSync14(repoDir)) return { branch: "", staged: [], unstaged: [] };
   const [branch, staged, unstaged] = await Promise.all([
     currentBranch(repoDir),
     changedFiles(repoDir, ["--cached"]),
@@ -73206,7 +73419,7 @@ async function workingStatus(repoDir) {
   return { branch, staged, unstaged };
 }
 async function workingFileDiff(repoDir, path, staged) {
-  if (!repoDir || !existsSync12(repoDir)) return null;
+  if (!repoDir || !existsSync14(repoDir)) return null;
   repoAbsPath(repoDir, path, true);
   const changed = staged ? await changedFiles(repoDir, ["--cached"]) : await withTempIndex(repoDir, (env) => changedFiles(repoDir, [], env));
   const cf = changed.find((c) => c.path === path);
@@ -73415,7 +73628,7 @@ async function deleteBranches(repoDir, names, opts2) {
 import { execFile as execFile9 } from "node:child_process";
 import { realpathSync as realpathSync8 } from "node:fs";
 import { stat as stat5 } from "node:fs/promises";
-import { basename as basename8, dirname as dirname12, join as join26, resolve as resolve17, sep as sep7 } from "node:path";
+import { basename as basename8, dirname as dirname13, join as join28, resolve as resolve17, sep as sep8 } from "node:path";
 import { promisify as promisify8 } from "node:util";
 var exec7 = promisify8(execFile9);
 var GIT6 = { timeout: 6e4, maxBuffer: 1 << 24, encoding: "utf8" };
@@ -73456,20 +73669,20 @@ var real = (p3) => {
     return realpathSync8(p3);
   } catch {
     const path = resolve17(p3);
-    const parent = dirname12(path);
-    return parent === path ? path : join26(real(parent), basename8(path));
+    const parent = dirname13(path);
+    return parent === path ? path : join28(real(parent), basename8(path));
   }
 };
 function hasWorktreeSession(path, sessionId2, sessions) {
   const target3 = real(path);
   return sessions.some((s2) => {
     const current = real(s2.cwd);
-    return s2.id === sessionId2 || current === target3 || current.startsWith(target3 + sep7);
+    return s2.id === sessionId2 || current === target3 || current.startsWith(target3 + sep8);
   });
 }
 async function bornAt(path) {
   try {
-    const st2 = await stat5(join26(path, ".git"));
+    const st2 = await stat5(join28(path, ".git"));
     const ms = st2.birthtimeMs > 0 ? st2.birthtimeMs : st2.mtimeMs;
     return new Date(ms).toISOString();
   } catch {
@@ -73494,7 +73707,7 @@ async function listWorktrees(repoDir, inputs) {
   const rows = [];
   for (const w of raw) {
     const path = resolve17(w.path);
-    if (path === trash || path.startsWith(trash + sep7)) continue;
+    if (path === trash || path.startsWith(trash + sep8)) continue;
     const name2 = basename8(path);
     const deletable = path !== baseReal && path !== mainPath;
     const spec = inputs.specs.get(name2);
@@ -73681,12 +73894,12 @@ async function recordHeadSha(specId, worktree, read2 = readHead) {
 init_local_binding();
 
 // src/services/session-worktree.ts
-import { resolve as resolve18, sep as sep8 } from "node:path";
+import { resolve as resolve18, sep as sep9 } from "node:path";
 function ownsWorktree(repoDir, cwd) {
   const base3 = resolve18(repoDir);
   const dir2 = resolve18(cwd);
   const container = resolve18(base3, ".worktrees");
-  return dir2 !== base3 && dir2 !== container && dir2.startsWith(container + sep8);
+  return dir2 !== base3 && dir2 !== container && dir2.startsWith(container + sep9);
 }
 
 // src/services/worktree-reaper.ts
@@ -73697,7 +73910,7 @@ init_notifications2();
 import { execFile as execFile11 } from "node:child_process";
 import { readdir as readdir4, rm as rm3 } from "node:fs/promises";
 import { promisify as promisify10 } from "node:util";
-import { join as join27, resolve as resolve19 } from "node:path";
+import { join as join29, resolve as resolve19 } from "node:path";
 var TICK_MS = 6e4;
 var trashDirOf = (repoDir) => resolve19(repoDir, ".worktrees", ".trash");
 var exec8 = promisify10(execFile11);
@@ -73758,7 +73971,7 @@ async function sweepRepo(repoDir, projectId, deps = prodReaperDeps) {
   }
   let removed = 0;
   for (const entry2 of entries4) {
-    const path = join27(dir2, entry2);
+    const path = join29(dir2, entry2);
     const known2 = pending.get(path);
     const row = known2 ?? { path, repoDir, projectId, entry: entry2, sessionId: sessionIdOf(entry2), since: Date.now() };
     pending.set(path, row);
@@ -74222,8 +74435,8 @@ function appendSourceHistory(current, entry2) {
 
 // src/services/spec-reset.ts
 import { execFile as execFile13 } from "node:child_process";
-import { existsSync as existsSync13 } from "node:fs";
-import { join as join28 } from "node:path";
+import { existsSync as existsSync15 } from "node:fs";
+import { join as join30 } from "node:path";
 import { promisify as promisify12 } from "node:util";
 
 // src/services/stage-artifacts.ts
@@ -74278,14 +74491,14 @@ async function planSpecReset(spec) {
   const repoDir = await resolveRepoDir(spec.projectId);
   if (!repoDir) return EMPTY3;
   const sid = sessionIdForSpec(spec.id);
-  const wt = join28(repoDir, ".worktrees", sid);
+  const wt = join30(repoDir, ".worktrees", sid);
   const branch = `hanoman/${sid}`;
   const hasBranch = await shaResolvable(repoDir, `refs/heads/${branch}`);
   return {
     // Berkas fase seluruh stage yang ditinggalkan — rentang yang sama persis dengan revert stage
     // SPEC-167, karena tujuan akhirnya memang sama: item berdiri lagi di `brainstorming`.
     wouldDelete: await artifactsToRemove(spec.projectId, spec.id, "brainstorming", spec.stage),
-    worktree: existsSync13(wt) ? wt : null,
+    worktree: existsSync15(wt) ? wt : null,
     branch: hasBranch ? branch : null
   };
 }
@@ -74362,6 +74575,61 @@ init_remote_session();
 init_registry();
 init_spec_attachment_dir();
 init_uploads();
+
+// src/services/spec-mockups.ts
+init_local_binding();
+init_spec_review2();
+import { existsSync as existsSync16, readdirSync as readdirSync9, realpathSync as realpathSync10, statSync as statSync5 } from "node:fs";
+import { readFile as readFile7 } from "node:fs/promises";
+import { extname as extname2, join as join33, sep as sep10 } from "node:path";
+var MOCKUP_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*\.(png|jpe?g|webp)$/i;
+var MIME = { ".png": "image/png", ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".webp": "image/webp" };
+var isDir = (p3) => {
+  try {
+    return statSync5(p3).isDirectory();
+  } catch {
+    return false;
+  }
+};
+async function resolveMockupDir(spec) {
+  const repoDir = await resolveRepoDir(spec.projectId);
+  if (!repoDir) return null;
+  const rel = join33("docs", "mockups", spec.id.toLowerCase());
+  const worktree = join33(worktreeDir(repoDir, spec.id), rel);
+  if (isDir(worktree)) return { source: "worktree", dir: worktree };
+  const repo = join33(repoDir, rel);
+  return isDir(repo) ? { source: "repo", dir: repo } : null;
+}
+async function listMockups(spec) {
+  const found = await resolveMockupDir(spec);
+  if (!found) return { source: null, dir: null, items: [] };
+  const items = readdirSync9(found.dir).filter((n2) => MOCKUP_NAME.test(n2)).sort().flatMap((name2) => {
+    try {
+      const st2 = statSync5(join33(found.dir, name2));
+      return st2.isFile() ? [{ name: name2, size: st2.size, modifiedAt: st2.mtime.toISOString() }] : [];
+    } catch {
+      return [];
+    }
+  });
+  return { source: found.source, dir: found.dir, items };
+}
+async function readMockup(spec, name2) {
+  if (!MOCKUP_NAME.test(name2)) return null;
+  const found = await resolveMockupDir(spec);
+  if (!found) return null;
+  const file = join33(found.dir, name2);
+  if (!existsSync16(file)) return null;
+  try {
+    const root = realpathSync10(found.dir);
+    const real2 = realpathSync10(file);
+    if (!real2.startsWith(root + sep10) || !statSync5(real2).isFile()) return null;
+    return { buf: await readFile7(real2), mime: MIME[extname2(real2).toLowerCase()] ?? "application/octet-stream" };
+  } catch {
+    return null;
+  }
+}
+
+// src/routes/specs.ts
 init_stage_machine();
 
 // src/services/spec-docs.ts
@@ -76843,7 +77111,7 @@ init_stage_machine();
 init_notifications2();
 init_sync_notify();
 init_spec_deps();
-import { createHash as createHash11 } from "node:crypto";
+import { createHash as createHash12 } from "node:crypto";
 var specNum = (id2) => Number.parseInt(id2.match(/\d+/)?.[0] ?? "0", 10);
 var selectOf = (shape) => Object.fromEntries(
   Object.keys(shape).filter((k) => k !== "blockedBy").map((k) => [k, true])
@@ -76935,7 +77203,7 @@ async function liveSignature() {
 async function specsDigest() {
   const agg = await prisma.spec.aggregate({ _count: { _all: true }, _max: { updatedAt: true }, _sum: { version: true } });
   const db = `${agg._count._all}:${agg._max.updatedAt?.getTime() ?? 0}:${agg._sum.version ?? 0}`;
-  return createHash11("sha1").update(`${db}|${await liveSignature()}`).digest("hex");
+  return createHash12("sha1").update(`${db}|${await liveSignature()}`).digest("hex");
 }
 async function liveSpecs(filter = {}) {
   await liveOverlayTick();
@@ -77263,6 +77531,24 @@ ${item.context}` : item.context;
     await syncSpecAttachmentsDir(spec.id, spec.projectId);
     return reply.code(201).send(result);
   });
+  app3.get("/specs/:id/mockups", async (req, reply) => {
+    const { id: id2 } = req.params;
+    const spec = await prisma.spec.findUnique({ where: { id: id2 }, select: { id: true, projectId: true } });
+    if (!spec) return reply.code(404).send({ error: "not found" });
+    return listMockups(spec);
+  });
+  app3.get("/specs/:id/mockups/:name", async (req, reply) => {
+    const { id: id2, name: name2 } = req.params;
+    const spec = await prisma.spec.findUnique({ where: { id: id2 }, select: { id: true, projectId: true } });
+    const file = spec ? await readMockup(spec, name2) : null;
+    if (!file) return reply.code(404).send({ error: "not found" });
+    reply.header("content-type", file.mime);
+    reply.header("content-disposition", `inline; filename="${name2}"`);
+    reply.header("x-content-type-options", "nosniff");
+    reply.header("content-security-policy", "sandbox; default-src 'none'");
+    reply.header("cache-control", "no-cache");
+    return reply.send(file.buf);
+  });
   app3.get("/specs/:id/attachments/:attId", async (req, reply) => {
     const { id: id2, attId } = req.params;
     const a = await prisma.specAttachment.findUnique({ where: { id: attId } });
@@ -77358,7 +77644,7 @@ ${item.context}` : item.context;
   });
   const specWithProject = (id2) => prisma.spec.findUnique({ where: { id: id2 }, include: { project: true } });
   const resolveReview = async (repoDir, spec) => {
-    if (existsSync14(worktreeDir(repoDir, spec.id))) return { wt: true };
+    if (existsSync17(worktreeDir(repoDir, spec.id))) return { wt: true };
     if (spec.baseSha && spec.headSha && await shaResolvable(repoDir, spec.baseSha) && await shaResolvable(repoDir, spec.headSha))
       return { wt: false, base: spec.baseSha, head: spec.headSha };
     const r = await specCommitRange(repoDir, spec.id);
@@ -77654,7 +77940,7 @@ import { spawn as spawn5 } from "node:child_process";
 // src/services/git-remotes.ts
 import { execFile as execFile16 } from "node:child_process";
 import { promisify as promisify15 } from "node:util";
-import { existsSync as existsSync17 } from "node:fs";
+import { existsSync as existsSync20 } from "node:fs";
 var exec10 = promisify15(execFile16);
 var GIT7 = { maxBuffer: 1 << 24, encoding: "utf8" };
 function parseRemote(url2) {
@@ -77673,7 +77959,7 @@ function prUrl(remoteUrl, branch, base3 = "main") {
   return null;
 }
 async function listRemotes(repoDir) {
-  if (!repoDir || !existsSync17(repoDir)) return [];
+  if (!repoDir || !existsSync20(repoDir)) return [];
   try {
     const { stdout } = await exec10("git", ["remote", "-v"], { cwd: repoDir, ...GIT7 });
     const map = /* @__PURE__ */ new Map();
@@ -77721,7 +78007,7 @@ init_integrate();
 init_safe_repo_path();
 import { lstat as lstat2, rename as rename4, rm as rm6 } from "node:fs/promises";
 import { createWriteStream } from "node:fs";
-import { join as join36 } from "node:path";
+import { join as join39 } from "node:path";
 import { randomUUID as randomUUID11 } from "node:crypto";
 import { pipeline } from "node:stream/promises";
 var EntryExistsError = class extends Error {
@@ -77782,7 +78068,7 @@ async function saveUpload2(repoDir, rel, source, opts2 = {}) {
   if (current && !opts2.overwrite) return { status: "exists" };
   if (current && !current.isFile())
     throw new PathContainmentError("repository path ditolak: target bukan file regular");
-  const temp = join36(entry2.parent, `.hanoman-${randomUUID11()}.tmp`);
+  const temp = join39(entry2.parent, `.hanoman-${randomUUID11()}.tmp`);
   try {
     await pipeline(source, createWriteStream(temp, { flags: "wx", mode: 384 }));
     if (opts2.isTruncated?.()) {
@@ -78273,15 +78559,15 @@ async function finishGraphOp(reply, id2, repoDir, r, verb) {
 // src/routes/fs.ts
 import { readdir as readdir8 } from "node:fs/promises";
 import { homedir as homedir9 } from "node:os";
-import { resolve as resolve22, dirname as dirname15, join as join37 } from "node:path";
+import { resolve as resolve22, dirname as dirname16, join as join40 } from "node:path";
 async function fs_default(app3) {
   app3.get("/fs/browse", async (req, reply) => {
     const q2 = req.query.path;
     const dir2 = q2 && q2.trim() ? resolve22(q2.trim()) : homedir9();
     try {
       const ents = await readdir8(dir2, { withFileTypes: true });
-      const entries4 = ents.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => ({ name: e.name, path: join37(dir2, e.name) })).sort((a, b) => a.name.localeCompare(b.name));
-      const parent = dirname15(dir2);
+      const entries4 = ents.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => ({ name: e.name, path: join40(dir2, e.name) })).sort((a, b) => a.name.localeCompare(b.name));
+      const parent = dirname16(dir2);
       return { path: dir2, parent: parent === dir2 ? null : parent, entries: entries4 };
     } catch {
       return reply.code(400).send({ error: `tak bisa membaca folder "${dir2}"` });
@@ -78295,7 +78581,7 @@ init_src();
 init_src2();
 init_session_phases();
 init_spec_review2();
-import { existsSync as existsSync18 } from "node:fs";
+import { existsSync as existsSync21 } from "node:fs";
 import { execFileSync as execFileSync9 } from "node:child_process";
 import { randomUUID as randomUUID13 } from "node:crypto";
 init_integrate();
@@ -78360,7 +78646,7 @@ function setBounded(map, key, value, maxKeys) {
 // src/services/auth.ts
 init_src2();
 init_db();
-import { randomBytes as randomBytes4, scrypt as scryptCb, timingSafeEqual as timingSafeEqual4, createHash as createHash16 } from "node:crypto";
+import { randomBytes as randomBytes4, scrypt as scryptCb, timingSafeEqual as timingSafeEqual4, createHash as createHash17 } from "node:crypto";
 import { promisify as promisify16 } from "node:util";
 var scrypt = promisify16(scryptCb);
 var COOKIE_NAME = "hn_session";
@@ -78378,7 +78664,7 @@ async function verifyPassword(pw, stored) {
   return key.length === want.length && timingSafeEqual4(key, want);
 }
 var newSessionToken = () => randomBytes4(32).toString("base64url");
-var sessionId = (token) => createHash16("sha256").update(token).digest("hex");
+var sessionId = (token) => createHash17("sha256").update(token).digest("hex");
 async function createSession2(userId) {
   const token = newSessionToken();
   await prisma.session.create({
@@ -78439,9 +78725,9 @@ function cookieOpts(req) {
 
 // src/services/device-token.ts
 init_db();
-import { randomBytes as randomBytes5, createHash as createHash17 } from "node:crypto";
+import { randomBytes as randomBytes5, createHash as createHash18 } from "node:crypto";
 var newDeviceToken = () => randomBytes5(32).toString("base64url");
-var tokenHash = (token) => createHash17("sha256").update(token).digest("hex");
+var tokenHash = (token) => createHash18("sha256").update(token).digest("hex");
 async function issueDeviceToken(userId, name2) {
   const token = newDeviceToken();
   const row = await prisma.deviceToken.create({ data: { userId, name: name2, tokenHash: tokenHash(token) } });
@@ -78654,14 +78940,14 @@ function installCommand(m, agent, shell = shellBin()) {
 init_local_binding();
 
 // src/services/terminal-diag.ts
-import { appendFileSync as appendFileSync4, mkdirSync as mkdirSync16, statSync as statSync4, rmSync as rmSync10 } from "node:fs";
-import { join as join38 } from "node:path";
+import { appendFileSync as appendFileSync4, mkdirSync as mkdirSync17, statSync as statSync6, rmSync as rmSync11 } from "node:fs";
+import { join as join41 } from "node:path";
 var DIAG_MAX_BYTES = 2 * 1024 * 1024;
 var KINDS = /* @__PURE__ */ new Set(["key", "comp", "data", "ack", "pred"]);
 var ID = /^[A-Za-z0-9_-]{1,64}$/;
 function diagFile(home3, sessionId2) {
   if (!ID.test(sessionId2)) throw new Error(`id sesi tak sah untuk diag: ${sessionId2}`);
-  return join38(home3, "diag", `${sessionId2}.jsonl`);
+  return join41(home3, "diag", `${sessionId2}.jsonl`);
 }
 function usable(ev) {
   if (!ev || typeof ev !== "object") return false;
@@ -78672,9 +78958,9 @@ function appendDiag(home3, sessionId2, events) {
   const file = diagFile(home3, sessionId2);
   const rows = events.filter(usable);
   if (!rows.length) return;
-  mkdirSync16(join38(home3, "diag"), { recursive: true });
+  mkdirSync17(join41(home3, "diag"), { recursive: true });
   try {
-    if (statSync4(file).size > DIAG_MAX_BYTES) rmSync10(file);
+    if (statSync6(file).size > DIAG_MAX_BYTES) rmSync11(file);
   } catch {
   }
   appendFileSync4(file, rows.map((r) => JSON.stringify(r)).join("\n") + "\n");
@@ -78754,11 +79040,11 @@ init_uploads();
 // src/services/agent-invocations.ts
 init_src();
 init_db();
-import { createHash as createHash18, randomUUID as randomUUID12 } from "node:crypto";
+import { createHash as createHash19, randomUUID as randomUUID12 } from "node:crypto";
 import { execFileSync as execFileSync8 } from "node:child_process";
 import { homedir as homedir10 } from "node:os";
-import { readFileSync as readFileSync19, realpathSync as realpathSync10, statSync as statSync5 } from "node:fs";
-import { isAbsolute as isAbsolute12, relative as relative7, resolve as resolve23 } from "node:path";
+import { readFileSync as readFileSync20, realpathSync as realpathSync11, statSync as statSync7 } from "node:fs";
+import { isAbsolute as isAbsolute12, relative as relative8, resolve as resolve23 } from "node:path";
 
 // src/services/session-event-relay.ts
 init_session_event_token();
@@ -78766,7 +79052,7 @@ init_session_event_spool();
 init_ingress_policy();
 import { constants as constants4 } from "node:fs";
 import { mkdir as mkdir8, open as open4, readdir as readdir9, rm as rm7 } from "node:fs/promises";
-import { join as join39 } from "node:path";
+import { join as join42 } from "node:path";
 var MAX_EVENT_BYTES = 1e6;
 var MAX_FILES_PER_DRAIN = 1e3;
 var SESSION_ID_RE = /^[a-z0-9_-]+$/;
@@ -78817,7 +79103,7 @@ async function drainSpool(app3, root, observation, host2) {
   let readBuffer;
   for (const session of await readdir9(root, { withFileTypes: true })) {
     if (!session.isDirectory() || !SESSION_ID_RE.test(session.name)) continue;
-    const dir2 = join39(root, session.name);
+    const dir2 = join42(root, session.name);
     let entries4;
     try {
       entries4 = await readdir9(dir2, { withFileTypes: true });
@@ -78829,7 +79115,7 @@ async function drainSpool(app3, root, observation, host2) {
       if (!entry2.isFile() || !entry2.name.endsWith(".json")) continue;
       const eventAt = /^(\d{1,15})-/.exec(entry2.name)?.[1];
       if (++examined > MAX_FILES_PER_DRAIN) return delivered;
-      const path = join39(dir2, entry2.name);
+      const path = join42(dir2, entry2.name);
       let payload;
       let handle;
       try {
@@ -78916,7 +79202,7 @@ var MAX_TRANSCRIPT_BYTES2 = 10 * 1024 * 1024;
 var ANSI2 = /[\u001b\u009b](?:\][^\u0007]*(?:\u0007|\u001b\\)|\[[0-?]*[ -/]*[@-~]|[@-_])/g;
 var snapshotHashes = /* @__PURE__ */ new Map();
 var keyOf = (x) => `${x.sessionId}\0${x.runtimeInvocationId}`;
-var hash3 = (value) => createHash18("sha256").update(value).digest("hex");
+var hash3 = (value) => createHash19("sha256").update(value).digest("hex");
 var defaultGitStatus = (cwd) => {
   try {
     return execFileSync8("git", ["-C", cwd, "status", "--porcelain=v1", "-z"], {
@@ -78951,7 +79237,7 @@ var transcriptRoots = () => [
   resolve23(process.env.CODEX_HOME ?? `${homedir10()}/.codex`)
 ];
 var inside = (path, root) => {
-  const rel = relative7(root, path);
+  const rel = relative8(root, path);
   return rel === "" || !rel.startsWith("..") && !isAbsolute12(rel);
 };
 var EMPTY_USAGE = { inputTokens: null, outputTokens: null, cachedTokens: null };
@@ -79024,12 +79310,12 @@ function usageFromText(text2) {
 function transcriptUsage(path, roots = transcriptRoots()) {
   if (!path) return EMPTY_USAGE;
   try {
-    const real2 = realpathSync10(path);
-    const safeRoots = roots.map((root) => realpathSync10(root));
+    const real2 = realpathSync11(path);
+    const safeRoots = roots.map((root) => realpathSync11(root));
     if (!safeRoots.some((root) => inside(real2, root))) return EMPTY_USAGE;
-    const info = statSync5(real2);
+    const info = statSync7(real2);
     if (!info.isFile() || info.size > MAX_TRANSCRIPT_BYTES2) return EMPTY_USAGE;
-    return usageFromText(readFileSync19(real2, "utf8"));
+    return usageFromText(readFileSync20(real2, "utf8"));
   } catch {
     return EMPTY_USAGE;
   }
@@ -79314,25 +79600,25 @@ init_ask();
 // src/services/decision-guard.ts
 init_src2();
 init_db();
-import { mkdirSync as mkdirSync17, readFileSync as readFileSync20, readdirSync as readdirSync9, rmSync as rmSync11, statSync as statSync6, writeFileSync as writeFileSync17 } from "node:fs";
-import { join as join40 } from "node:path";
+import { mkdirSync as mkdirSync18, readFileSync as readFileSync21, readdirSync as readdirSync11, rmSync as rmSync12, statSync as statSync8, writeFileSync as writeFileSync18 } from "node:fs";
+import { join as join43 } from "node:path";
 var SESSION_HEADER = "x-hanoman-session";
 var SAFE_ID = /^[A-Za-z0-9._-]{1,200}$/;
 var launchers = /* @__PURE__ */ new Map();
 var STALE_MS = 30 * 24 * 60 * 6e4;
-var launcherDir = (env = process.env) => join40(resolveHome(env), "session-launchers");
+var launcherDir = (env = process.env) => join43(resolveHome(env), "session-launchers");
 function recordLauncher(sessionId2, agentId, env = process.env) {
   if (!SAFE_ID.test(sessionId2)) return;
   const known2 = launchersFor(sessionId2, env);
   known2.add(agentId);
   try {
     const dir2 = launcherDir(env);
-    mkdirSync17(dir2, { recursive: true, mode: 448 });
-    writeFileSync17(join40(dir2, sessionId2), [...known2].join("\n"), { mode: 384 });
+    mkdirSync18(dir2, { recursive: true, mode: 448 });
+    writeFileSync18(join43(dir2, sessionId2), [...known2].join("\n"), { mode: 384 });
     const now = Date.now();
-    for (const f of readdirSync9(dir2)) {
+    for (const f of readdirSync11(dir2)) {
       try {
-        if (now - statSync6(join40(dir2, f)).mtimeMs > STALE_MS) rmSync11(join40(dir2, f), { force: true });
+        if (now - statSync8(join43(dir2, f)).mtimeMs > STALE_MS) rmSync12(join43(dir2, f), { force: true });
       } catch {
       }
     }
@@ -79344,7 +79630,7 @@ function launchersFor(sessionId2, env) {
   if (hot) return hot;
   const ids = /* @__PURE__ */ new Set();
   try {
-    for (const l of readFileSync20(join40(launcherDir(env), sessionId2), "utf8").split("\n")) if (l.trim()) ids.add(l.trim());
+    for (const l of readFileSync21(join43(launcherDir(env), sessionId2), "utf8").split("\n")) if (l.trim()) ids.add(l.trim());
   } catch {
   }
   launchers.set(sessionId2, ids);
@@ -79796,7 +80082,7 @@ async function terminal_default(app3, opts2) {
     if (!repoDir) return { ok: false, code: 409, msg: "project belum punya repoDir" };
     if (!s2.cwd.includes("/.worktrees/"))
       return { ok: false, code: 409, msg: "belum ada worktree untuk di-review \u2014 jalankan/lanjutkan sesi dulu", empty: "no-worktree" };
-    if (!existsSync18(s2.cwd))
+    if (!existsSync21(s2.cwd))
       return { ok: false, code: 409, msg: "belum ada worktree untuk di-review \u2014 jalankan/lanjutkan sesi dulu", empty: "no-commit" };
     return { ok: true, id: s2.id, repoDir };
   };
@@ -80059,7 +80345,7 @@ async function terminalWorkspaceRoutes(app3) {
 // src/routes/vps.ts
 init_db();
 init_src();
-import { readFileSync as readFileSync25, existsSync as existsSync22 } from "node:fs";
+import { readFileSync as readFileSync26, existsSync as existsSync24 } from "node:fs";
 import { homedir as homedir12 } from "node:os";
 
 // src/vps/catalog/catalog.data.ts
@@ -80267,14 +80553,14 @@ function resolveComponents(ids, profile) {
 }
 
 // src/services/vps-provision.ts
-import { readFileSync as readFileSync22 } from "node:fs";
+import { readFileSync as readFileSync23 } from "node:fs";
 
 // src/services/vps-ssh.ts
 init_config2();
 import { spawn as spawn6 } from "node:child_process";
-import { mkdtempSync as mkdtempSync4, rmSync as rmSync12, writeFileSync as writeFileSync18 } from "node:fs";
+import { mkdtempSync as mkdtempSync4, rmSync as rmSync13, writeFileSync as writeFileSync19 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
-import { dirname as dirname16, join as join41 } from "node:path";
+import { dirname as dirname17, join as join44 } from "node:path";
 var sshBin = () => effectiveStr("HANOMAN_SSH_BIN") ?? "ssh";
 function consoleArgv(t) {
   return [
@@ -80289,9 +80575,9 @@ function consoleArgv(t) {
   ];
 }
 function askpassScript() {
-  const dir2 = mkdtempSync4(join41(tmpdir7(), "hanoman-askpass-"));
-  const path = join41(dir2, "askpass.sh");
-  writeFileSync18(path, `#!/bin/sh
+  const dir2 = mkdtempSync4(join44(tmpdir7(), "hanoman-askpass-"));
+  const path = join44(dir2, "askpass.sh");
+  writeFileSync19(path, `#!/bin/sh
 printf '%s' "$HANOMAN_SSH_PASSWORD"
 `, { mode: 448 });
   return path;
@@ -80330,7 +80616,7 @@ function sshExec(t, remoteCmd, opts2 = {}) {
     const timer11 = setTimeout(() => p3.kill("SIGKILL"), opts2.timeoutMs ?? 6e4);
     const done = (r) => {
       clearTimeout(timer11);
-      if (askpass) rmSync12(dirname16(askpass), { recursive: true, force: true });
+      if (askpass) rmSync13(dirname17(askpass), { recursive: true, force: true });
       resolve25(r);
     };
     p3.stdout.on("data", (d) => {
@@ -80350,26 +80636,10 @@ function sshExec(t, remoteCmd, opts2 = {}) {
 
 // src/services/vps-audit.ts
 init_db();
-import { existsSync as existsSync20, readFileSync as readFileSync21 } from "node:fs";
-import { join as join43 } from "node:path";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
-
-// src/runner/deps.ts
-import { existsSync as existsSync19 } from "node:fs";
-import { dirname as dirname17, join as join42 } from "node:path";
-function repoRootFrom(startDir) {
-  let dir2 = startDir;
-  for (let i = 0; i < 8; i++) {
-    if (existsSync19(join42(dir2, "pnpm-workspace.yaml"))) return dir2;
-    const parent = dirname17(dir2);
-    if (parent === dir2) break;
-    dir2 = parent;
-  }
-  return startDir;
-}
-var repoRoot = (startDir = process.cwd()) => repoRootFrom(startDir);
-
-// src/services/vps-audit.ts
+init_deps();
+import { existsSync as existsSync22, readFileSync as readFileSync22 } from "node:fs";
+import { join as join45 } from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
 init_sync_notify();
 
 // src/vps/scoring.ts
@@ -80469,11 +80739,11 @@ function parseHealth(out4) {
   return { uptime: h2.uptime ?? "", disk: h2.disk ?? "", mem: h2.mem ?? "", load: h2.load ?? "" };
 }
 var target2 = (v) => ({ host: v.host, port: v.port, user: v.user, keyPath: v.keyPath });
-var packagedScript = (f) => fileURLToPath4(new URL(`../scripts/vps/${f}`, import.meta.url));
-var moduleDir = () => fileURLToPath4(new URL(".", import.meta.url));
+var packagedScript = (f) => fileURLToPath5(new URL(`../scripts/vps/${f}`, import.meta.url));
+var moduleDir2 = () => fileURLToPath5(new URL(".", import.meta.url));
 var scriptPath = (f) => {
   const packed = packagedScript(f);
-  return existsSync20(packed) ? packed : join43(repoRoot(moduleDir()), "server", "scripts", "vps", f);
+  return existsSync22(packed) ? packed : join45(repoRoot(moduleDir2()), "server", "scripts", "vps", f);
 };
 async function itemStatesOf(vpsId) {
   const rows = await prisma.vpsItemState.findMany({ where: { vpsId } });
@@ -80483,7 +80753,7 @@ async function runAudit(v) {
   const r = await sshExec(
     target2(v),
     "sudo -n bash -s",
-    { stdin: readFileSync21(scriptPath("audit.sh"), "utf8"), timeoutMs: 6e4 }
+    { stdin: readFileSync22(scriptPath("audit.sh"), "utf8"), timeoutMs: 6e4 }
   );
   const audit = parseAudit(r.out);
   if (r.code !== 0 || audit.length === 0) return { ok: false, out: r.out };
@@ -80563,7 +80833,7 @@ function parseProvisionSteps(out4) {
     return m ? [{ item: m[1], status: m[2], detail: (m[3] ?? "").trim() }] : [];
   });
 }
-var script = () => readFileSync22(scriptPath("provision.sh"), "utf8");
+var script = () => readFileSync23(scriptPath("provision.sh"), "utf8");
 async function probeComponents(v) {
   const r = await sshExec(v, "env MODE=probe bash -s", { stdin: script(), timeoutMs: PROBE_TIMEOUT_MS });
   const components2 = parseComponents(r.out);
@@ -80590,7 +80860,7 @@ async function readSetupToken(v, home3 = "/var/lib/hanoman") {
 }
 
 // src/services/vps-remediate.ts
-import { readFileSync as readFileSync23 } from "node:fs";
+import { readFileSync as readFileSync24 } from "node:fs";
 function parseSteps2(out4) {
   return out4.split("\n").flatMap((line) => {
     const m = line.match(/^STEP (\S+) (would|ok|fail)(?: (.*))?$/);
@@ -80601,7 +80871,7 @@ async function remediate(v, items, dryRun) {
   const r = await sshExec(
     v,
     `sudo -n env ITEMS=${items.join(",")} SSH_PORT=${v.port} DRY_RUN=${dryRun ? "1" : ""} bash -s`,
-    { stdin: readFileSync23(scriptPath("remediate.sh"), "utf8"), timeoutMs: 3e5 }
+    { stdin: readFileSync24(scriptPath("remediate.sh"), "utf8"), timeoutMs: 3e5 }
   );
   return { ok: r.code === 0, steps: parseSteps2(r.out), out: r.out };
 }
@@ -80718,47 +80988,47 @@ async function listVpsWithScore() {
 init_src2();
 init_config2();
 import { execFileSync as execFileSync10 } from "node:child_process";
-import { chmodSync as chmodSync9, copyFileSync, existsSync as existsSync21, mkdirSync as mkdirSync18, readFileSync as readFileSync24, unlinkSync as unlinkSync5 } from "node:fs";
+import { chmodSync as chmodSync10, copyFileSync, existsSync as existsSync23, mkdirSync as mkdirSync19, readFileSync as readFileSync25, unlinkSync as unlinkSync5 } from "node:fs";
 import { homedir as homedir11 } from "node:os";
-import { join as join44 } from "node:path";
+import { join as join46 } from "node:path";
 var keyDir = () => effectiveStr("HANOMAN_SSH_KEY_DIR") ?? resolveDataDirs().sshKeys;
 var KEY_FILES = ["id_ed25519", "id_ed25519.pub"];
 function adoptLegacyKey(dir2) {
   if (effectiveStr("HANOMAN_SSH_KEY_DIR")) return;
-  const legacy = join44(homedir11(), ".hanoman");
+  const legacy = join46(homedir11(), ".hanoman");
   if (legacy === dir2) return;
-  if (!KEY_FILES.every((f) => existsSync21(join44(legacy, f)))) return;
-  mkdirSync18(dir2, { recursive: true, mode: 448 });
+  if (!KEY_FILES.every((f) => existsSync23(join46(legacy, f)))) return;
+  mkdirSync19(dir2, { recursive: true, mode: 448 });
   for (const f of KEY_FILES) {
-    copyFileSync(join44(legacy, f), join44(dir2, f));
-    chmodSync9(join44(dir2, f), 384);
+    copyFileSync(join46(legacy, f), join46(dir2, f));
+    chmodSync10(join46(dir2, f), 384);
   }
-  for (const f of KEY_FILES) unlinkSync5(join44(legacy, f));
+  for (const f of KEY_FILES) unlinkSync5(join46(legacy, f));
   console.log(`vps: key SSH dipindah dari ${legacy} ke ${dir2} (SPEC-846 \u2014 satu batas backup)`);
 }
 function ensureHanomanKey() {
   const dir2 = keyDir();
-  const privPath = join44(dir2, KEY_FILES[0]);
+  const privPath = join46(dir2, KEY_FILES[0]);
   const pubPath = `${privPath}.pub`;
-  if (!existsSync21(privPath)) adoptLegacyKey(dir2);
-  if (!existsSync21(privPath)) {
-    mkdirSync18(dir2, { recursive: true, mode: 448 });
+  if (!existsSync23(privPath)) adoptLegacyKey(dir2);
+  if (!existsSync23(privPath)) {
+    mkdirSync19(dir2, { recursive: true, mode: 448 });
     execFileSync10(
       "ssh-keygen",
       ["-t", "ed25519", "-N", "", "-C", "hanoman", "-f", privPath],
       { stdio: ["ignore", "ignore", "pipe"] }
     );
   }
-  return { privPath, pubPath, pub: readFileSync24(pubPath, "utf8").trim() };
+  return { privPath, pubPath, pub: readFileSync25(pubPath, "utf8").trim() };
 }
 
 // src/services/vps-bootstrap.ts
 var INSTALL_CMD = `mkdir -p ~/.ssh && chmod 700 ~/.ssh && touch ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys && k=$(cat) && { grep -qxF "$k" ~/.ssh/authorized_keys || printf '%s\\n' "$k" >> ~/.ssh/authorized_keys; }`;
 async function bootstrapKey(t, password) {
   const { privPath, pub } = ensureHanomanKey();
-  const install = await sshExec(t, INSTALL_CMD, { stdin: `${pub}
+  const install2 = await sshExec(t, INSTALL_CMD, { stdin: `${pub}
 `, password, timeoutMs: 6e4 });
-  if (install.code !== 0) return { ok: false, out: install.out };
+  if (install2.code !== 0) return { ok: false, out: install2.out };
   const verify = await sshExec({ ...t, keyPath: privPath }, "true", { timeoutMs: 3e4 });
   if (verify.code !== 0) return { ok: false, out: verify.out };
   return { ok: true, keyPath: privPath };
@@ -80769,7 +81039,7 @@ init_session_launch_gate();
 init_settings3();
 init_sync_notify();
 function keyMissing(v) {
-  return !!v.keyPath && !existsSync22(v.keyPath);
+  return !!v.keyPath && !existsSync24(v.keyPath);
 }
 async function vps_default(app3) {
   app3.get("/vps", async () => listVpsWithScore());
@@ -80997,7 +81267,7 @@ async function vps_default(app3) {
     const r = await sshExec(
       v,
       `sudo -n env SSH_PORT=${v.port} SSH_USER=${v.user} bash -s`,
-      { stdin: readFileSync25(scriptPath("harden.sh"), "utf8"), timeoutMs: 3e5 }
+      { stdin: readFileSync26(scriptPath("harden.sh"), "utf8"), timeoutMs: 3e5 }
     );
     if (r.code !== 0) return reply.code(502).send({ error: "harden gagal lewat ssh", transcript: r.out });
     const verify = await sshExec(v, "true", { timeoutMs: 3e4 });
@@ -81146,8 +81416,8 @@ async function antigravity(app3) {
 init_src2();
 init_src();
 import { randomUUID as randomUUID14 } from "node:crypto";
-import { readFile as readFile8, writeFile as writeFile6, rename as rename5, mkdir as mkdir9, rm as rm9 } from "node:fs/promises";
-import { dirname as dirname18, join as join46 } from "node:path";
+import { readFile as readFile9, writeFile as writeFile6, rename as rename5, mkdir as mkdir9, rm as rm9 } from "node:fs/promises";
+import { dirname as dirname18, join as join48 } from "node:path";
 
 // src/services/model-catalog-parser.ts
 init_zod();
@@ -81254,7 +81524,7 @@ init_session_sandbox();
 import { spawn as spawn7 } from "node:child_process";
 import { mkdtemp as mkdtemp2, rm as rm8 } from "node:fs/promises";
 import { tmpdir as tmpdir8 } from "node:os";
-import { join as join45 } from "node:path";
+import { join as join47 } from "node:path";
 var MAX_BYTES = 4 * 1024 * 1024;
 var TIMEOUT_MS = 2e4;
 var quote3 = (s2) => "'" + s2.replaceAll("'", "'\\''") + "'";
@@ -81353,7 +81623,7 @@ function runCatalogCommand(command, agent, cwd, env, timeoutMs = TIMEOUT_MS) {
 }
 async function probeModelCatalog(agent) {
   assertAntigravityLaunch(agent);
-  const cwd = await mkdtemp2(join45(tmpdir8(), "hanoman-models-"));
+  const cwd = await mkdtemp2(join47(tmpdir8(), "hanoman-models-"));
   const env = agentEnvironment(agent, process.env);
   for (const key of ["HANOMAN_CLAUDE_BIN", "HANOMAN_CODEX_BIN", "HANOMAN_PODMAN_BIN", "HANOMAN_ANTIGRAVITY_BIN"]) {
     const value = effectiveStr(key);
@@ -81464,12 +81734,12 @@ async function writeModelCatalogCache(file, catalog, current = () => true) {
     await rm9(temp, { force: true });
   }
 }
-var cacheFile = () => join46(resolveHome(), "model-catalog.json");
+var cacheFile = () => join48(resolveHome(), "model-catalog.json");
 var modelCatalogService = createModelCatalogService({
   probe: probeModelCatalog,
   key: catalogProbeKey,
   read: async () => {
-    const content = await readFile8(cacheFile(), "utf8");
+    const content = await readFile9(cacheFile(), "utf8");
     if (Buffer.byteLength(content) > 4 * 1024 * 1024) throw new Error("oversized cache");
     return JSON.parse(content);
   },
@@ -82653,8 +82923,8 @@ init_db();
 init_pty();
 init_config5();
 init_inbox();
-import { mkdirSync as mkdirSync19, writeFileSync as writeFileSync19 } from "node:fs";
-import { join as join47 } from "node:path";
+import { mkdirSync as mkdirSync20, writeFileSync as writeFileSync20 } from "node:fs";
+import { join as join49 } from "node:path";
 init_human_input();
 var idle = /* @__PURE__ */ new Set();
 var sending = /* @__PURE__ */ new Set();
@@ -82665,7 +82935,7 @@ function isLeadIdle(id2) {
   return idle.has(id2);
 }
 var HUMAN_QUIET_MS = 12e4;
-var batchDir = (projectId) => join47(resolveHome(), "lead-batches", projectId);
+var batchDir = (projectId) => join49(resolveHome(), "lead-batches", projectId);
 var briefFn = async () => "(situasi tak tersedia \u2014 panggil /brief)";
 function setBriefBuilder(fn) {
   briefFn = fn;
@@ -82685,9 +82955,9 @@ var prodCourierDeps = {
   brief: (p3) => briefFn(p3).catch(() => "(situasi tak tersedia \u2014 panggil /brief)"),
   write: (projectId, text2) => {
     const dir2 = batchDir(projectId);
-    mkdirSync19(dir2, { recursive: true });
-    const file = join47(dir2, `${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}.md`);
-    writeFileSync19(file, text2);
+    mkdirSync20(dir2, { recursive: true });
+    const file = join49(dir2, `${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}.md`);
+    writeFileSync20(file, text2);
     return file;
   },
   send: (id2, line) => sendToPane(id2, line),
@@ -83485,7 +83755,7 @@ init_src();
 init_db();
 import { gunzipSync, gzipSync } from "node:zlib";
 import { mkdir as mkdir10, rename as rename6, writeFile as writeFile7 } from "node:fs/promises";
-import { join as join48 } from "node:path";
+import { join as join50 } from "node:path";
 
 // src/services/device-auth.ts
 function bearerToken2(req) {
@@ -83743,9 +84013,9 @@ async function sync_default(app3) {
       const deviceId = req.device.id;
       const withTranscriptKey = await Promise.all(parsed.data.entries.map(async (e) => {
         if (!e.transcript) return e;
-        const dir2 = join48(resolveDataDirs().home, "remote-transcripts", deviceId);
+        const dir2 = join50(resolveDataDirs().home, "remote-transcripts", deviceId);
         await mkdir10(dir2, { recursive: true, mode: 448 });
-        const final = join48(dir2, `${e.seq}.txt`);
+        const final = join50(dir2, `${e.seq}.txt`);
         const tmp = `${final}.tmp`;
         await writeFile7(tmp, e.transcript, { encoding: "utf8", mode: 384 });
         await rename6(tmp, final);
@@ -84300,9 +84570,9 @@ init_db();
 init_db();
 init_uploads();
 init_src();
-import { createHash as createHash20, randomBytes as randomBytes7 } from "node:crypto";
+import { createHash as createHash21, randomBytes as randomBytes7 } from "node:crypto";
 function hashAccessKey(key) {
-  return createHash20("sha256").update(key).digest("hex");
+  return createHash21("sha256").update(key).digest("hex");
 }
 function generateAccessKey() {
   const key = "hnm_tkt_" + randomBytes7(24).toString("hex");
@@ -87148,9 +87418,9 @@ init_codex_trust();
 init_qa_attachment_transfer();
 init_uploads();
 init_ask_via2();
-import { createHash as createHash21 } from "node:crypto";
+import { createHash as createHash22 } from "node:crypto";
 import { execFileSync as execFileSync11 } from "node:child_process";
-import { join as join50 } from "node:path";
+import { join as join52 } from "node:path";
 var QaSessionError = class extends Error {
   constructor(code, message, needsBind = false) {
     super(message);
@@ -87158,7 +87428,7 @@ var QaSessionError = class extends Error {
     this.needsBind = needsBind;
   }
 };
-var qaSessionId = (findingId) => `qa-${createHash21("sha256").update(findingId).digest("hex").slice(0, 24)}`;
+var qaSessionId = (findingId) => `qa-${createHash22("sha256").update(findingId).digest("hex").slice(0, 24)}`;
 async function startQaFindingSession(d, fid) {
   const f = d.findings.find((x) => x.id === fid);
   if (!f) throw new QaSessionError(404, "temuan tidak ditemukan");
@@ -87177,7 +87447,7 @@ async function startQaFindingSession(d, fid) {
       const saved = await saveSessionUpload(id2, bytes, a.mimeType);
       files2.push(`${JSON.stringify(a.filename)} (${a.mimeType}): ${saved.path}`);
     }
-    const wt = join50(repoDir, ".worktrees", id2);
+    const wt = join52(repoDir, ".worktrees", id2);
     const branch = `qa/${id2.slice(3)}`;
     const reused = realGit.worktreeAlive(wt);
     try {
@@ -88720,9 +88990,9 @@ ${baru}`;
 // src/services/portal-chat/workspace.ts
 init_src();
 init_db();
-import { mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync5, rmSync as rmSync13, writeFileSync as writeFileSync20 } from "node:fs";
+import { mkdirSync as mkdirSync21, mkdtempSync as mkdtempSync5, rmSync as rmSync14, writeFileSync as writeFileSync21 } from "node:fs";
 import { tmpdir as tmpdir9 } from "node:os";
-import { join as join51 } from "node:path";
+import { join as join53 } from "node:path";
 var STAGE_LABEL = {
   brainstorming: "Dirumuskan",
   objective: "Dirumuskan",
@@ -88765,7 +89035,7 @@ function renderTicketDoc(tickets2) {
 ${baris.join("\n")}`;
 }
 async function buildChatWorkspace(projectId) {
-  const dir2 = mkdtempSync5(join51(tmpdir9(), "hanoman-portal-chat-"));
+  const dir2 = mkdtempSync5(join53(tmpdir9(), "hanoman-portal-chat-"));
   try {
     const project = await prisma.project.findUnique({
       where: { id: projectId },
@@ -88780,7 +89050,7 @@ async function buildChatWorkspace(projectId) {
     });
     const files2 = [];
     const tulis = (rel, isi) => {
-      writeFileSync20(join51(dir2, rel), isi, { mode: 384 });
+      writeFileSync21(join53(dir2, rel), isi, { mode: 384 });
       files2.push(rel);
     };
     tulis("project.md", renderProjectDoc(project));
@@ -88788,16 +89058,16 @@ async function buildChatWorkspace(projectId) {
     tulis("laporan.md", renderTicketDoc(tickets2.map((t) => toPortalTicket(t, null))));
     const prds = await listPrds(projectId);
     if (prds.length) {
-      mkdirSync20(join51(dir2, "dokumen"), { mode: 448 });
+      mkdirSync21(join53(dir2, "dokumen"), { mode: 448 });
       for (const prd of prds) {
         const isi = await readPrd(projectId, prd.path);
         if (!isi) continue;
-        tulis(join51("dokumen", `${prd.slug.replaceAll("/", "-")}.md`), isi);
+        tulis(join53("dokumen", `${prd.slug.replaceAll("/", "-")}.md`), isi);
       }
     }
-    return { dir: dir2, files: files2, cleanup: () => rmSync13(dir2, { recursive: true, force: true }) };
+    return { dir: dir2, files: files2, cleanup: () => rmSync14(dir2, { recursive: true, force: true }) };
   } catch (error) {
-    rmSync13(dir2, { recursive: true, force: true });
+    rmSync14(dir2, { recursive: true, force: true });
     throw error;
   }
 }
@@ -89317,20 +89587,20 @@ init_src();
 init_db();
 
 // src/services/bootstrap.ts
-import { createHash as createHash22, randomBytes as randomBytes11, timingSafeEqual as timingSafeEqual5 } from "node:crypto";
-import { chmod as chmod2, lstat as lstat3, mkdir as mkdir11, readFile as readFile9, unlink as unlink5, writeFile as writeFile8 } from "node:fs/promises";
-import { join as join52 } from "node:path";
+import { createHash as createHash23, randomBytes as randomBytes11, timingSafeEqual as timingSafeEqual5 } from "node:crypto";
+import { chmod as chmod2, lstat as lstat3, mkdir as mkdir11, readFile as readFile10, unlink as unlink5, writeFile as writeFile8 } from "node:fs/promises";
+import { join as join54 } from "node:path";
 var TTL_MS7 = 15 * 6e4;
 var SETUP_TOKEN_FILE = "setup.token";
 var BootstrapError = class extends Error {
   code = "BOOTSTRAP_PROOF";
 };
-var tokenPath = (home3) => join52(home3, SETUP_TOKEN_FILE);
+var tokenPath = (home3) => join54(home3, SETUP_TOKEN_FILE);
 async function readStored(home3) {
   try {
     const info = await lstat3(tokenPath(home3));
     if (info.isSymbolicLink() || !info.isFile()) throw new BootstrapError("invalid setup proof");
-    const [token, expires] = (await readFile9(tokenPath(home3), "utf8")).trim().split("\n");
+    const [token, expires] = (await readFile10(tokenPath(home3), "utf8")).trim().split("\n");
     const expiresAt = Date.parse(expires ?? "");
     if (!token || !Number.isFinite(expiresAt)) throw new BootstrapError("invalid setup proof");
     return { token, expiresAt };
@@ -89370,8 +89640,8 @@ ${new Date(expiresAt).toISOString()}
 }
 async function verifySetupToken(candidate, home3, now = Date.now()) {
   const stored = await readStored(home3);
-  const got = createHash22("sha256").update(candidate).digest();
-  const want = createHash22("sha256").update(stored.token).digest();
+  const got = createHash23("sha256").update(candidate).digest();
+  const want = createHash23("sha256").update(stored.token).digest();
   if (stored.expiresAt <= now || !timingSafeEqual5(got, want)) throw new BootstrapError("invalid setup proof");
 }
 async function consumeSetupToken(home3) {
@@ -90162,8 +90432,8 @@ init_db();
 init_event_log();
 init_transcript_store();
 init_src2();
-import { readFile as readFile10 } from "node:fs/promises";
-import { join as join53 } from "node:path";
+import { readFile as readFile11 } from "node:fs/promises";
+import { join as join55 } from "node:path";
 function decodeCursor(c) {
   if (!c) return null;
   try {
@@ -90201,9 +90471,9 @@ async function readRemoteTranscript(id2) {
   const row = await prisma.logEntry.findUnique({ where: { id: id2 } });
   if (!row || row.lane !== "transcript" || !row.transcriptKey) return null;
   if (row.deviceId === "local") return readTranscript(row.transcriptKey);
-  const path = join53(resolveDataDirs().home, "remote-transcripts", row.transcriptKey);
+  const path = join55(resolveDataDirs().home, "remote-transcripts", row.transcriptKey);
   try {
-    return await readFile10(path, "utf8");
+    return await readFile11(path, "utf8");
   } catch {
     return null;
   }
@@ -90398,7 +90668,7 @@ var SETUP_PUBLIC = /* @__PURE__ */ new Set([
   "POST /api/setup"
 ]);
 function buildApp({ requireAuth = true, agentDocFile, env = process.env } = {}) {
-  const docFile = agentDocFile !== void 0 ? agentDocFile : pickGuideFile(dirname19(fileURLToPath5(import.meta.url)), env, existsSync23);
+  const docFile = agentDocFile !== void 0 ? agentDocFile : pickGuideFile(dirname19(fileURLToPath6(import.meta.url)), env, existsSync25);
   const ingress = loadIngressPolicy(env);
   const app3 = Fastify({ logger: false, trustProxy: trustProxyFromEnv(env) });
   app3.setErrorHandler((error, _req, reply) => {
@@ -90547,7 +90817,7 @@ function buildApp({ requireAuth = true, agentDocFile, env = process.env } = {})
     await api.register(qaBacklog);
   }, { prefix: "/api" });
   if (shouldServeWeb(env)) {
-    const dist = pickWebDir(dirname19(fileURLToPath5(import.meta.url)), env, existsSync23);
+    const dist = pickWebDir(dirname19(fileURLToPath6(import.meta.url)), env, existsSync25);
     if (dist) {
       app3.register(fastifyStatic, { root: dist });
       app3.setNotFoundHandler((req, reply) => req.url.startsWith("/api") ? reply.code(404).send({ error: "not found" }) : req.url.startsWith("/assets/") ? reply.code(404).type("text/plain").send("not found") : reply.sendFile("index.html"));
@@ -90992,6 +91262,7 @@ async function resumeReconciledSessions(cutoff, deps = prodDeps4) {
 init_event_log();
 init_settings3();
 init_custom_agents2();
+init_bundled_skills();
 init_pty();
 init_bootstrap();
 
@@ -91483,9 +91754,9 @@ async function pruneLogs(now, retention, opts2 = {}) {
 }
 async function reconcileRemoteTranscripts() {
   const { readdir: readdir10, unlink: unlink6, stat: stat8 } = await import("node:fs/promises");
-  const { join: join54 } = await import("node:path");
+  const { join: join56 } = await import("node:path");
   const { resolveDataDirs: resolveDataDirs2 } = await Promise.resolve().then(() => (init_src2(), src_exports));
-  const root = join54(resolveDataDirs2().home, "remote-transcripts");
+  const root = join56(resolveDataDirs2().home, "remote-transcripts");
   let deviceDirs;
   try {
     deviceDirs = await readdir10(root);
@@ -91499,16 +91770,16 @@ async function reconcileRemoteTranscripts() {
   for (const dev of deviceDirs) {
     let files2;
     try {
-      files2 = await readdir10(join54(root, dev));
+      files2 = await readdir10(join56(root, dev));
     } catch {
       continue;
     }
     for (const f of files2) {
       const key = `${dev}/${f}`;
       if (referenced.has(key)) continue;
-      const st2 = await stat8(join54(root, dev, f)).catch(() => null);
+      const st2 = await stat8(join56(root, dev, f)).catch(() => null);
       if (!st2 || Date.now() - st2.mtimeMs < gracePeriodMs) continue;
-      await unlink6(join54(root, dev, f)).catch(() => {
+      await unlink6(join56(root, dev, f)).catch(() => {
       });
       orphans++;
     }
@@ -91743,6 +92014,9 @@ bootstrapReady.then(async () => {
     console.error("config runtime gagal dimuat \u2014 memakai env/default:", e);
   }
   await installCustomAgents();
+  const skills2 = seedBundledSkills(home2);
+  if (skills2.seeded.length || skills2.updated.length)
+    console.log(`skill bundel: di-seed ${skills2.seeded.join(", ") || "-"} \xB7 diperbarui ${skills2.updated.join(", ") || "-"}`);
   return app2.listen({ port, host });
 }).then(async () => {
   console.log(`hanoman api ${host}:${port}`);